Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Create Icp Tiers
v1.0.0Classify companies into Ideal Customer Profile (ICP) tiers based on firmographic data (industry + employee count). Creates a custom property via API and 4 cl...
⭐ 0· 49·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name, description, SKILL.md instructions, and code all target HubSpot CRM property creation and classification checks — that is coherent with the claimed purpose. The scripts call the HubSpot API (api.hubapi.com) and create/verify a company property, which fits the stated intent.
Instruction Scope
Runtime instructions and scripts are scoped to HubSpot API calls and local CSV audit outputs. They do not attempt to access unrelated systems or external endpoints other than api.hubapi.com. However, the SKILL.md examples and scripts refer to loading environment variables (.env) for access tokens, and the SKILL.md and code use two different env-var names (HUBSPOT_API_TOKEN in SKILL.md examples vs. HUBSPOT_ACCESS_TOKEN in scripts), introducing ambiguity about what secret is required.
Install Mechanism
There is no install spec in the registry (instruction-only), which is lower risk. But the included Python scripts declare required packages in file header comments (requests, python-dotenv). Those dependencies will not be automatically installed by the registry because no install spec exists — the user must install them manually. This mismatch between code-declared dependencies and registry install metadata is a usability/security note (missing explicit install steps).
Credentials
The code requires a HubSpot access token (used as HUBSPOT_ACCESS_TOKEN in scripts) with permission to read/search companies and to create company properties. That credential is proportionate to the task, but the registry metadata lists no required env vars or primary credential. Additionally, the SKILL.md example references a different env name (HUBSPOT_API_TOKEN). This inconsistency increases the risk of accidental misconfiguration or accidental exposure of the wrong secret. The skill also loads a .env from the repository directory, which means users might be tempted to commit credentials there — warn against that.
Persistence & Privilege
The skill is not always-on, does not request platform-wide privileges, and does not modify other skills or system settings. It only performs HubSpot API operations and writes local CSV audit files; no elevated platform persistence is requested.
What to consider before installing
This skill is functionally aligned with creating an ICP Tier property in HubSpot and verifying results, but it contains several actionable inconsistencies you should resolve before installing or running it:
1) Credentials: The scripts expect a HubSpot token (scripts reference HUBSPOT_ACCESS_TOKEN), while SKILL.md examples use HUBSPOT_API_TOKEN — the registry metadata currently declares no required env var. Confirm which env var the deployment expects and ensure the registry metadata is updated. Provide a least-privilege token or OAuth credential that only grants the scopes needed (read/search companies, read/write company properties), and test in a development HubSpot account first. Never store tokens in a repo .env that will be committed or shared.
2) Dependencies and installation: The Python scripts list dependencies (requests, python-dotenv) in comments but there is no install spec. Make sure the runtime will have these packages installed or add explicit install instructions to avoid runtime errors.
3) Review behavior: The scripts will create a company property and write CSV audit files into the scripts directory. Confirm the hardcoded PROPERTY_NAME ("company_segment") matches your CRM naming conventions before running. Also note that classification workflows are not created automatically — the SKILL.md instructs manual workflow creation in the HubSpot UI.
4) Safety steps: Run the scripts with a sandbox/dev HubSpot account first, verify the property and outputs, and inspect the CSVs locally. If you plan to run in production, rotate the token after testing and ensure it has minimal scopes.
If these issues are addressed (declare the required env var(s) in metadata, unify the env-var name, and add install instructions), the skill is coherent and usable. As-is, the mismatches warrant caution.Like a lobster shell, security has layers — review code before you run it.
latestvk976rp45drbwwtn4d5bthekn9183nytx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.