Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Fix Lifecycle Stages
v1.0.0Ensure all contacts and companies have appropriate lifecycle stages. Backfills missing stages via API, fixes records stuck at disallowed stages, and creates...
⭐ 0· 68·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description and the scripts all target HubSpot lifecycle-stage fixes — that is coherent. However, the registry metadata declared no required environment variables or primary credential, while every script expects a HubSpot API token. This mismatch is unexpected and should be resolved (the skill cannot operate without the token).
Instruction Scope
SKILL.md and the three scripts restrict actions to HubSpot's CRM API (search, batch update) and local CSV outputs. They read a .env file and an environment variable for the API token and write CSV audit files in the scripts directory. They do not call unknown third-party endpoints or attempt to read unrelated system files, but they do explicitly load a parent .env file which may contain other secrets — verify what will be present in that .env before running.
Install Mechanism
There is no install spec even though the package includes three Python scripts with dependency comments. That means the skill is instruction-only but ships runnable code; there's no automatic installation of dependencies. This is a packaging inconsistency you should be aware of (you'll need to install Python and the dependencies yourself before running).
Credentials
The scripts require a HubSpot token, but the registry lists no required env vars. Additionally, SKILL.md example code uses HUBSPOT_API_TOKEN while scripts use HUBSPOT_ACCESS_TOKEN — the env var name mismatch is a concrete inconsistency that could lead to misconfiguration or accidental token leakage. Aside from HubSpot, no other credentials are requested, and the token requirement is proportionate to the task if the token's scope is properly limited.
Persistence & Privilege
The skill does not request elevated platform privileges, does not set always:true, and does not modify other skills or global agent settings. It runs as an on-demand script and writes only local CSV audit files.
What to consider before installing
This skill appears to actually do what its description says (audit and fix HubSpot lifecycle stages), but there are important inconsistencies you should address before using it:
- Environment variable mismatch: the repository scripts expect a HUBSPOT_ACCESS_TOKEN (scripts) while SKILL.md examples reference HUBSPOT_API_TOKEN; the registry lists no required env vars. Confirm which env var the runtime will provide and update the skill or your environment accordingly.
- Token scope and placement: the scripts load a .env file from the project parent directory. Ensure that file only contains the token intended for this script and no unrelated secrets. Use a least-privilege HubSpot token that only includes the scopes needed (CRM read/write and any workflow scopes required), and prefer a test/dev HubSpot account first.
- Packaging/installation: there is no install spec. You will need Python (>=3.10) and to manually install dependencies (requests, python-dotenv) before running. Review and run the scripts locally or in a sandbox before giving the token to any automated system.
- Backup and safety: the script performs bulk updates. It has a SAFETY_THRESHOLD (50,000) and rate-limit handling, but you should back up data and run the 'before' audit on a copy or limited subset first to validate behavior.
- Audit outputs: the scripts write CSV audit trails into the scripts directory. Inspect these files and their storage location to avoid leaking sensitive contact data.
If you decide to proceed: verify and rename or harmonize the expected env var, test in a non-production HubSpot account, limit the token scopes, and inspect the code to ensure the token is used only for the HubSpot API calls shown.Like a lobster shell, security has layers — review code before you run it.
latestvk97dc82f9cd10x771g29ynjxpx83n829
License
MIT-0
Free to use, modify, and redistribute. No attribution required.