Hubspot Audit

This skill appears to implement a real HubSpot audit, but there are a few red flags to address before running it: - The SKILL.md expects a HubSpot API token (HUBSPOT_API_TOKEN) but the skill metadata does not declare that credential — ask the publisher why the token is missing from the registry metadata. - Do not run commands exactly as written until you confirm what 'uv pip install' is meant to be (likely a typo). Use a known installer (e.g., pip) or run dependency installation in an isolated environment (virtualenv, container). - The instructions tell you to write the API token into a plaintext .env file. Prefer supplying the token via your platform's secret manager, environment variables injected at runtime, or a securely permissioned file rather than saving it in a repo or user home directory. - Review the generated script (scripts/audit_portal.py) before executing it so you can verify it only calls the HubSpot APIs you expect and does not exfiltrate data elsewhere. - If possible, create a HubSpot private app with the minimum required scopes (read-only where possible) and test the audit on a non-production portal or a limited dataset first. If the publisher can confirm and fix the metadata to declare HUBSPOT_API_TOKEN, correct the install instruction to a standard command (or provide an explicit install spec), and document where secrets are stored, the skill would be much more acceptable.