Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Hubspot Crm

v1.0.0

Gère contacts et deals dans HubSpot CRM pour USC SYNERGY : rechercher, créer, modifier, associer, et suivre le pipeline de ventes.

0· 563·4 current·4 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mibbou/hubspot-crm.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Hubspot Crm" (mibbou/hubspot-crm) from ClawHub.
Skill page: https://clawhub.ai/mibbou/hubspot-crm
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install hubspot-crm

ClawHub CLI

Package manager switcher

npx clawhub@latest install hubspot-crm
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
SKILL.md contains curl commands that call api.hubapi.com to search, create, update contacts/deals/notes/tasks — this matches the stated HubSpot CRM purpose. However the registry metadata declares no required credentials while the instructions clearly require HUBSPOT_ACCESS_TOKEN (incoherence between declared requirements and actual instructions).
Instruction Scope
Instructions are narrowly scoped to HubSpot's API (api.hubapi.com) and typical CRM operations. They do not (in the visible portion) request reading arbitrary files, other environment variables, or POSTing to unrelated endpoints. A date command is used to timestamp notes, which is reasonable.
Install Mechanism
No install spec and no code files — instruction-only skill. This is low-risk from an installation/execution perspective (nothing is written to disk by the skill itself).
!
Credentials
The SKILL.md requires a single credential (HUBSPOT_ACCESS_TOKEN), which is appropriate for HubSpot API access, but the skill's registry metadata did not declare any required env vars or primary credential. That mismatch is concerning because it obscures the fact that a secret must be provided. Confirming the token's required scopes and that only that token is needed would reduce risk.
Persistence & Privilege
The skill is not always-enabled, has no install steps, and does not request persistent system-wide changes. It does reference a default owner ID, which is benign configuration data.
What to consider before installing
This skill's commands look consistent with a HubSpot integration, but the published metadata omits the fact that you must provide HUBSPOT_ACCESS_TOKEN. Before installing: 1) verify the skill source/author (no homepage/source provided) and confirm you trust them; 2) require that the metadata be fixed to list HUBSPOT_ACCESS_TOKEN as a required credential; 3) if you proceed, supply a HubSpot token with the minimum scopes needed (read/write contacts/deals only), not a broad admin token; 4) review the full SKILL.md (the provided snippet was truncated) to ensure there are no hidden or unrelated network calls; 5) consider creating a dedicated HubSpot API key/app for this integration so you can revoke it easily if needed.

Like a lobster shell, security has layers — review code before you run it.

latestvk97adntevgzg14rn1x7y1ex18x81qgkp
563downloads
0stars
1versions
Updated 3h ago
v1.0.0
MIT-0

Skill HubSpot CRM — USC SYNERGY

Description

Gestion complète du CRM HubSpot pour USC SYNERGY (centre de formation VAE). Permet de rechercher, créer, modifier des contacts et deals, gérer les associations, et suivre le pipeline commercial.

Configuration requise

  • Variable d'environnement : HUBSPOT_ACCESS_TOKEN
  • Owner par défaut : Mark IBBOU (ID: 32587387)

Pipelines

PipelineIDUsage
Sales PipelinedefaultPipeline principal
Traitement des leads859619884Qualification prospects

Stages du Sales Pipeline (default)

StageID
Appointment Scheduledappointmentscheduled
Qualified To Buyqualifiedtobuy
Presentation Scheduledpresentationscheduled
Decision Maker Bought-Indecisionmakerboughtin
Contract Sentcontractsent
Closed Wonclosedwon
Closed Lostclosedlost

Propriétés contact importantes

  • phone, mobilephone, hs_whatsapp_phone_number — Téléphones
  • source — Source du contact
  • ref — Référence interne
  • objet — Objet de la demande
  • fonction — Fonction professionnelle

Commandes disponibles

1. Rechercher un contact par téléphone

curl -s "https://api.hubapi.com/crm/v3/objects/contacts/search" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filterGroups": [{
      "filters": [{
        "propertyName": "phone",
        "operator": "EQ",
        "value": "NUMERO_TEL"
      }]
    }],
    "properties": ["firstname","lastname","email","phone","mobilephone","hs_whatsapp_phone_number","source","ref","objet","fonction"]
  }'

Remplacer NUMERO_TEL par le numéro au format international (+33...) Si aucun résultat, retenter avec mobilephone ou hs_whatsapp_phone_number

2. Rechercher un contact par email

curl -s "https://api.hubapi.com/crm/v3/objects/contacts/search" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filterGroups": [{
      "filters": [{
        "propertyName": "email",
        "operator": "EQ",
        "value": "EMAIL_ADDRESS"
      }]
    }],
    "properties": ["firstname","lastname","email","phone","mobilephone","source","ref","objet"]
  }'

3. Rechercher un contact par nom

curl -s "https://api.hubapi.com/crm/v3/objects/contacts/search" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filterGroups": [{
      "filters": [{
        "propertyName": "lastname",
        "operator": "EQ",
        "value": "NOM_FAMILLE"
      }]
    }],
    "properties": ["firstname","lastname","email","phone","mobilephone","source","ref","objet"]
  }'

4. Obtenir un contact par ID

curl -s "https://api.hubapi.com/crm/v3/objects/contacts/CONTACT_ID?properties=firstname,lastname,email,phone,mobilephone,hs_whatsapp_phone_number,source,ref,objet,fonction" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN"

5. Créer un nouveau contact

curl -s "https://api.hubapi.com/crm/v3/objects/contacts" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "firstname": "PRENOM",
      "lastname": "NOM",
      "email": "EMAIL",
      "phone": "TELEPHONE",
      "source": "SOURCE",
      "hubspot_owner_id": "32587387"
    }
  }'

6. Mettre à jour un contact

curl -s -X PATCH "https://api.hubapi.com/crm/v3/objects/contacts/CONTACT_ID" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "PROPRIETE": "VALEUR"
    }
  }'

7. Lister les deals d'un contact

curl -s "https://api.hubapi.com/crm/v4/objects/contacts/CONTACT_ID/associations/deals" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN"

Récupère les IDs des deals, puis utiliser commande 9 pour les détails

8. Créer un deal

curl -s "https://api.hubapi.com/crm/v3/objects/deals" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "dealname": "VAE - NOM_CANDIDAT - DIPLOME",
      "pipeline": "default",
      "dealstage": "appointmentscheduled",
      "amount": "MONTANT",
      "hubspot_owner_id": "32587387"
    }
  }'

9. Obtenir un deal par ID

curl -s "https://api.hubapi.com/crm/v3/objects/deals/DEAL_ID?properties=dealname,pipeline,dealstage,amount,closedate,hubspot_owner_id" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN"

10. Mettre à jour le stage d'un deal

curl -s -X PATCH "https://api.hubapi.com/crm/v3/objects/deals/DEAL_ID" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "dealstage": "STAGE_ID"
    }
  }'

11. Associer un contact à un deal

curl -s -X PUT "https://api.hubapi.com/crm/v4/objects/deals/DEAL_ID/associations/contacts/CONTACT_ID" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '[{"associationCategory":"HUBSPOT_DEFINED","associationTypeId":3}]'

12. Créer une note sur un contact

curl -s "https://api.hubapi.com/crm/v3/objects/notes" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "hs_note_body": "CONTENU_NOTE",
      "hs_timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%S.000Z)'"
    }
  }'

Après création, associer la note au contact avec commande 13

13. Associer une note à un contact

curl -s -X PUT "https://api.hubapi.com/crm/v4/objects/notes/NOTE_ID/associations/contacts/CONTACT_ID" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '[{"associationCategory":"HUBSPOT_DEFINED","associationTypeId":202}]'

14. Créer une tâche

curl -s "https://api.hubapi.com/crm/v3/objects/tasks" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "hs_task_subject": "SUJET_TACHE",
      "hs_task_body": "DESCRIPTION",
      "hs_task_status": "NOT_STARTED",
      "hs_task_priority": "MEDIUM",
      "hs_timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%S.000Z)'",
      "hubspot_owner_id": "32587387"
    }
  }'

15. Associer une tâche à un contact

curl -s -X PUT "https://api.hubapi.com/crm/v4/objects/tasks/TASK_ID/associations/contacts/CONTACT_ID" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '[{"associationCategory":"HUBSPOT_DEFINED","associationTypeId":204}]'

16. Lister les contacts récents (dernières 24h)

curl -s "https://api.hubapi.com/crm/v3/objects/contacts/search" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filterGroups": [{
      "filters": [{
        "propertyName": "createdate",
        "operator": "GTE",
        "value": "'$(date -d '24 hours ago' +%s)000'"
      }]
    }],
    "sorts": [{"propertyName":"createdate","direction":"DESCENDING"}],
    "properties": ["firstname","lastname","email","phone","source","createdate"],
    "limit": 20
  }'

17. Lister les deals par stage

curl -s "https://api.hubapi.com/crm/v3/objects/deals/search" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filterGroups": [{
      "filters": [{
        "propertyName": "dealstage",
        "operator": "EQ",
        "value": "STAGE_ID"
      }]
    }],
    "properties": ["dealname","dealstage","amount","closedate","pipeline"],
    "limit": 50
  }'

18. Compter les deals par pipeline

curl -s "https://api.hubapi.com/crm/v3/objects/deals/search" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "filterGroups": [{
      "filters": [{
        "propertyName": "pipeline",
        "operator": "EQ",
        "value": "PIPELINE_ID"
      }]
    }],
    "limit": 0
  }'

Le champ total dans la réponse donne le nombre

19. Recherche globale de contacts

curl -s "https://api.hubapi.com/crm/v3/objects/contacts/search" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "TERME_RECHERCHE",
    "properties": ["firstname","lastname","email","phone","source"],
    "limit": 10
  }'

20. Supprimer un contact (archiver)

curl -s -X DELETE "https://api.hubapi.com/crm/v3/objects/contacts/CONTACT_ID" \
  -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN"

Action irréversible — demander confirmation avant exécution


Scénarios métier

Nouveau prospect WhatsApp

  1. Rechercher par téléphone (cmd 1) sur les 3 champs
  2. Si inexistant → Créer contact (cmd 5) avec source="WhatsApp"
  3. Créer deal VAE (cmd 8)
  4. Associer contact au deal (cmd 11)
  5. Créer note avec contexte conversation (cmd 12 + 13)

Suivi candidat VAE

  1. Rechercher contact (cmd 1/2/3)
  2. Lister ses deals (cmd 7)
  3. Récupérer détails deal (cmd 9)
  4. Mettre à jour stage si progression (cmd 10)
  5. Ajouter note de suivi (cmd 12 + 13)

Rapport pipeline quotidien

  1. Compter deals par pipeline (cmd 18)
  2. Lister deals par stage (cmd 17) pour chaque stage actif
  3. Lister contacts créés dernières 24h (cmd 16)

Webhooks n8n (à configurer)

WebhookURLUsage
Nouveau prospecthttps://uscsynergy.app.n8n.cloud/webhook/hubspot-nouveau-prospectSync nouveau contact vers Digiforma
Sync Digiformahttps://uscsynergy.app.n8n.cloud/webhook/hubspot-sync-digiformaMise à jour bidirectionnelle
Enrichissement WhatsApphttps://uscsynergy.app.n8n.cloud/webhook/hubspot-enrichissement-whatsappEnrichir fiche depuis conversation WA

Note : Ces webhooks sont des placeholders. Les activer dans n8n quand les workflows seront prêts.

Comments

Loading comments...