HubSpot CRM

Full HubSpot CRM automation — contacts, deals, companies, activities, and pipeline reports via the HubSpot API.

Security Scan

The skill code and README clearly require a HubSpot private app token (HUBSPOT_API_KEY) and only talk to api.hubapi.com, but the registry metadata does not declare any required credentials and the package provenance is unknown — this mismatch and missing provenance is suspicious.

Purpose & Capability

Name/description match the code: the Python CLI implements contacts, deals, companies, activities and reports via the HubSpot API, which legitimately requires a HubSpot API token. However, the registry metadata lists no required environment variables or primary credential even though both SKILL.md and the script require HUBSPOT_API_KEY. That metadata mismatch is an incoherence.

Instruction Scope

SKILL.md instructs only to set HUBSPOT_API_KEY and to run the provided CLI commands. The instructions stay inside the stated purpose and reference only HubSpot API usage. They do not instruct reading unrelated files, scanning system state, or sending data to external endpoints other than api.hubapi.com.

Install Mechanism

No install spec (instruction-only with a bundled script). This is low-risk — nothing is downloaded or installed automatically by the skill bundle. The script requires the 'requests' Python package, which is documented in SKILL.md.

Credentials

The code and SKILL.md require a HUBSPOT_API_KEY (a bearer token) with CRM scopes, which is appropriate for the stated functionality. But the registry metadata declares no required env vars or primary credential — that omission is unexpected and reduces transparency. Also provenance is unknown (no source/homepage), increasing risk if the token is provided without verifying the skill's origin.

Persistence & Privilege

The skill is not 'always' enabled and does not request elevated platform privileges or modify other skills. It can be invoked by the user and (by default) autonomously, which is the platform norm and acceptable here given the rest of the footprint.

What to consider before installing

This skill's code and README legitimately require a HubSpot private app token (HUBSPOT_API_KEY) and only call api.hubapi.com. However, the registry metadata does not advertise that credential and the package has no listed source or homepage. Before installing, verify the skill's provenance (who published it), confirm you trust that publisher, and ensure you use a least-privilege HubSpot private app token with only the scopes documented. Consider testing in an isolated environment or with a dedicated HubSpot sandbox account/token first. If you need higher assurance, ask the publisher to update registry metadata to declare HUBSPOT_API_KEY as a required credential and to provide a source URL or repository you can audit.

Automate your entire HubSpot CRM from the command line. Create and manage contacts, deals, and companies; log activities (calls, emails, meetings, notes); and pull pipeline reports with conversion rates — all via the official HubSpot API with a single Bearer token.

Setup

Set your HubSpot Private App token as an environment variable:

export HUBSPOT_API_KEY="pat-na1-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Get your token: HubSpot → Settings → Integrations → Private Apps → Create a private app. Required scopes: crm.objects.contacts, crm.objects.deals, crm.objects.companies, crm.schemas.contacts, sales-email-read.

Commands / Usage

# ── CONTACTS ────────────────────────────────────────────
# List contacts (default 20, up to 100)
python3 scripts/hubspot_crm.py contacts-list
python3 scripts/hubspot_crm.py contacts-list --limit 50

# Search contacts by email or name
python3 scripts/hubspot_crm.py contacts-search --query "[e-mail]"
python3 scripts/hubspot_crm.py contacts-search --query "John Smith"

# Create a contact
python3 scripts/hubspot_crm.py contacts-create --email "[e-mail]" --firstname "Jane" --lastname "Doe" --phone "[phone]" --company "Acme"

# Update a contact
python3 scripts/hubspot_crm.py contacts-update --id 12345 --phone "[phone]" --jobtitle "CTO"

# Delete a contact
python3 scripts/hubspot_crm.py contacts-delete --id 12345

# ── DEALS ───────────────────────────────────────────────
# List all deals
python3 scripts/hubspot_crm.py deals-list
python3 scripts/hubspot_crm.py deals-list --limit 50

# Create a deal
python3 scripts/hubspot_crm.py deals-create --name "Acme Enterprise License" --stage "appointmentscheduled" --amount 12000 --contact-id 12345

# Update a deal
python3 scripts/hubspot_crm.py deals-update --id 67890 --stage "closedwon" --amount 15000

# Move deal stage
python3 scripts/hubspot_crm.py deals-move-stage --id 67890 --stage "contractsent"

# List pipeline stages
python3 scripts/hubspot_crm.py pipeline-list

# ── COMPANIES ───────────────────────────────────────────
# Create a company
python3 scripts/hubspot_crm.py companies-create --name "Acme Corp" --domain "acme.com" --industry "TECHNOLOGY"

# Search companies
python3 scripts/hubspot_crm.py companies-search --query "Acme"

# Associate contact with company
python3 scripts/hubspot_crm.py companies-associate --company-id 11111 --contact-id 22222

# ── ACTIVITIES ──────────────────────────────────────────
# Log an email activity
python3 scripts/hubspot_crm.py log-email --contact-id 12345 --subject "Follow-up" --body "Hi Jane, just checking in..."

# Log a call
python3 scripts/hubspot_crm.py log-call --contact-id 12345 --duration 300 --notes "Discussed pricing, very interested"

# Log a meeting
python3 scripts/hubspot_crm.py log-meeting --contact-id 12345 --title "Demo call" --notes "Showed product, positive feedback"

# Log a note
python3 scripts/hubspot_crm.py log-note --contact-id 12345 --body "Called and left voicemail"

# ── REPORTS ─────────────────────────────────────────────
# Get deal pipeline summary
python3 scripts/hubspot_crm.py report-pipeline

# Get conversion rates per stage
python3 scripts/hubspot_crm.py report-conversions

Requirements

• Python 3.8+
• requests (standard: pip install requests)
• HUBSPOT_API_KEY environment variable