Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Delete No Email Contacts

v1.0.0

Delete contacts with no email address from a HubSpot CRM instance. These contacts cannot receive any communication and inflate billing. Fully automated via t...

0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name, SKILL.md, and included scripts all consistently implement deletion of HubSpot contacts missing an email address via the HubSpot CRM APIs. However, the skill package/registry metadata does NOT declare the required environment variable or primary credential (HUBSPOT_ACCESS_TOKEN) even though the scripts require it, which is an inconsistency.
Instruction Scope
All runtime instructions and scripts are scoped to HubSpot API actions (search, export for audit, batch archive) and local CSV logging. The SKILL.md requires user confirmation and describes a safety threshold prior to deletion. The scripts do not attempt to read unrelated system paths or call external endpoints other than api.hubapi.com.
Install Mechanism
There is no install spec in the registry (instruction-only), which is low risk. The scripts include comment metadata listing Python and two dependencies (requests, python-dotenv) but the registry will not automatically install them. Users must install the Python runtime and the listed packages manually (or via their own environment). No external downloads or unexpected installers are used.
!
Credentials
The code requires a HubSpot private app access token (HUBSPOT_ACCESS_TOKEN) with read/write scopes — this is proportionate to the task. The concern is that the published registry metadata does not list any required environment variables or a primary credential, which is misleading and could cause users to miss the fact that a high-privilege token is needed and will be read from a .env file.
Persistence & Privilege
The skill is not force-included (always: false) and does not request persistent system privileges or modify other skills or system-wide configurations. It runs as normal scripts and requires explicit interactive confirmation before deleting.
What to consider before installing
This skill appears to implement what it claims, but take these precautions before installing or running it: - Verify credentials: The scripts expect a HubSpot private app access token (HUBSPOT_ACCESS_TOKEN) with crm.objects.contacts.read and crm.objects.contacts.write scopes. The registry metadata does not declare this — do not proceed until you confirm where the token will come from and that it's least-privilege. - Review the code: Inspect before.py and the CSV produced to ensure the contacts targeted are the ones you intend to remove. - Run in stages: Run before.py first, review the generated data/no-email-contacts-before.csv, and only run execute.py after manual confirmation. The scripts already ask for a manual 'DELETE' confirmation but verify the CSV yourself first. - Adjust safety thresholds: The scripts include SAFETY_THRESHOLD/ABORT_THRESHOLD values. Set these conservatively (based on your before-state count) to avoid mass accidental deletion. - Secure the token: The scripts load a .env file in the repository root. Storing tokens in plaintext files has risk — prefer setting the token in your environment or a secure secrets manager and avoid committing .env to source control. After use, consider rotating the token. - Dependencies: The package metadata is only in script comments; ensure you have Python 3.10+ and install requests and python-dotenv before running. - Test in a safe environment: If possible, test against a HubSpot sandbox or a copy of your data first. Because the manifest fails to disclose the required credential, treat the registry entry as incomplete and proceed cautiously.

Like a lobster shell, security has layers — review code before you run it.

latestvk970ee3xgts2dycstbkee55sg583m2tw

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments