Cleanup Forms

Audit and remove unused, test, or deprecated forms from HubSpot. Identifies forms with zero submissions, forms not embedded on any page, and test forms left...

Security Scan

The skill's instructions look like a reasonable HubSpot forms cleanup procedure, but the metadata omits a required HubSpot API token and glosses over other API scope and dependency needs, so the package is internally inconsistent and needs clarification before use.

Purpose & Capability

The skill's stated purpose (audit and remove HubSpot forms) matches the actions described in SKILL.md (calling the Forms API, identifying candidates, deleting via API or UI). However, the SKILL.md explicitly requires a HUBSPOT_API_TOKEN and the hubspot-api-client Python package, but the registry metadata declares no required environment variables or dependencies — this mismatch is unexpected and unexplained.

Instruction Scope

Instructions focus on listing forms, flagging candidates, checking references (workflows, embedded pages, pop-ups), and deleting. Checking whether a form is embedded or referenced may require additional HubSpot APIs or manual UI checks; the doc notes plan-level 403s but does not list which extra API scopes/endpoints will be used or how to discover embeddings/reference usage programmatically. Deletion is irreversible in HubSpot, and the instructions correctly recommend exports, but the instructions leave implementation details vague (e.g., how to detect embeddings or workflow triggers).

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing will be written to disk by an installer. The runtime assumes Python and a third-party client library, but the skill does not attempt to install them itself — that is a low install risk but shifts responsibility to the user/agent environment.

Credentials

SKILL.md requires a HUBSPOT_API_TOKEN (stored in .env) and the hubspot-api-client package, but the skill metadata lists no required env vars; this discrepancy is a red flag. The single credential requested by the instructions is proportionate to the task, but the token will likely need broad HubSpot scopes (forms, workflows, CMS/pages, possibly CMS API for embedded checks). The SKILL.md does not enumerate required API scopes or permissions.

Persistence & Privilege

The skill does not request persistent presence (always: false) and does not modify other skills or system config. Autonomous invocation is allowed by default, which is normal; there is no evidence the skill requests elevated platform privileges.

What to consider before installing

This skill appears to be a plausible HubSpot forms cleanup recipe, but you should not install or run it without clarifying a few things: (1) SKILL.md expects a HUBSPOT_API_TOKEN (via .env) and a Python client library — the registry metadata fails to declare that; confirm the skill's metadata is corrected. (2) Confirm what HubSpot API scopes the token must have (Forms, Workflows, CMS/pages, CTA) because deletion and reference checks may need broad access; use a token with the minimum required scopes and avoid using an admin key unless necessary. (3) The SKILL.md mentions possible 403s on some plans — verify your HubSpot plan/API access before relying on automated deletion. (4) Deletions are irreversible in HubSpot: export form definitions and back up any submission data before deleting. (5) The document has a minor typo ('uv' for installation) — ask the author how they expect you to install dependencies. If you cannot get these clarifications, treat the skill as untrusted and perform the audit manually in HubSpot UI or with your own vetted scripts.

Audit HubSpot forms to remove unused and test forms. Stale forms clutter the forms dashboard and can cause confusion when building workflows or reports.

Prerequisites

• HubSpot API token in .env
• Python with hubspot-api-client installed via uv
• Note: The Forms API may return 403 on some plan tiers. If so, perform the audit manually in the HubSpot UI under Marketing > Forms.

Step-by-Step Instructions

Stage 1: Before — Inventory All Forms

Pull all forms via the API:

from hubspot import HubSpot

api_client = HubSpot(access_token=os.getenv("HUBSPOT_API_TOKEN"))
forms = api_client.marketing.forms.forms_api.get_page(limit=100)

For each form, record: form ID, name, type, submission count, created date, last submission date.

Stage 2: Execute — Identify Candidates for Deletion

Flag forms matching any of these criteria:

1. Zero submissions and created more than 30 days ago
2. No recent submissions (last submission 6+ months ago) and not embedded on an active page
3. Test forms (names containing "test", "temp", "draft", "copy of")
4. Deprecated forms replaced by newer versions

Before deleting, check:

• Is the form referenced in any workflow enrollment trigger?
• Is the form embedded on any live landing page or website page?
• Is the form used in any pop-up or slide-in CTA?

Stage 3: After — Delete and Document

1. Delete confirmed unused forms via the API or UI.
2. Document what was deleted in a cleanup log.
3. If a form with submissions is deleted, the submission data is retained on the contact records — but the form definition is gone.

Stage 4: Rollback

• Deleted forms cannot be restored in HubSpot.
• Before deleting a form with any submissions, export the form definition (field names, settings) so it can be recreated.
• Contact records retain their form submission history regardless of form deletion.

Tips

• Establish a naming convention: [TEAM] - Purpose - Version (e.g., [Marketing] - Webinar Registration - v2).
• Prefix deprecated forms with "[DEPRECATED]" instead of deleting immediately — delete after one quarter of no usage.