📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills hubspot-integration
📦
hubspot-integration
Content revision r2 High Risk ⚙️ External commands🌐 Network access🔑 Env variables
Build Secure HubSpot CRM Integrations
HubSpot integrations require careful authentication, object handling, pagination, and webhook processing. This skill provides practical Node.js and Python patterns for common CRM workflows.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "hubspot-integration" from https://skillstore.io/skills/sickn33-hubspot-integration.md and its manifest at https://skillstore.io/api/skills/sickn33-hubspot-integration/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "hubspot-integration". Create a private app contact reader with pagination.
Expected outcome:
A Node.js implementation plan that loads a named token, requests selected properties, follows cursors, and retries bounded rate-limit responses.
Using "hubspot-integration". Review my HubSpot webhook endpoint.
Expected outcome:
A security checklist covering raw-body preservation, signature v3 inputs, timing-safe comparison, timestamp freshness, fast responses, and asynchronous event processing.
Using "hubspot-integration". Plan a project custom object linked to contacts and companies.
Expected outcome:
A schema plan with required properties, field types, supported associations, record operations, search behavior, and Enterprise subscription constraints.
Security Audit
High Riskv5 • 7/24/2026 Open versioned report
The static findings are false positives involving expected HubSpot API requests, scoped environment variables, JavaScript interpolation, and CRM identifier mapping. However, the OAuth example omits state validation, and the webhook example does not implement HubSpot signature v3 correctly.
1
Files scanned
837
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (2)
High
OAuth State Validation Is Missing
The authorization URL omits a random state parameter, and the callback exchanges a code without validating state. This permits OAuth login CSRF or account misbinding.
The complete authorization URL and callback example shows no state generation, session binding, or validation.
High
HubSpot Signature v3 Verification Is Incorrect
The handler reads the v3 header but verifies a hex HMAC over only the serialized body. HubSpot v3 requires additional request data, Base64 output, and timing-safe comparison.
The example explicitly reads the v3 signature and timestamp, but the HMAC covers only JSON.stringify(req.body) and uses direct string equality.
Risk Factors
⚙️ External commands (1)
🌐 Network access (5)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-hubspot-integration/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-hubspot-integration?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-hubspot-integration?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-hubspot-integration/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-hubspot-integration.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). hubspot-integration security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-hubspot-integration/audits/5BibTeX citation
@techreport{sickn33-sickn33-hubspot-integration-2026,
author = {sickn33},
title = {hubspot-integration security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-hubspot-integration/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "hubspot-integration security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/sickn33-hubspot-integration/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-hubspot-integration:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
74
Spec Compliance
What You Can Build
Synchronize CRM contacts
Design contact creation, updates, searches, pagination, and batches for an application integration.
Configure an internal CRM connection
Plan a private app integration with scoped access, token handling, associations, and rate-limit controls.
Review webhook ingestion
Assess signature verification, replay protection, response timing, and queued event processing before deployment.
Try These Prompts
Connect a private app
Create a Node.js HubSpot private app client using an environment variable. Add paginated contact retrieval and bounded rate-limit retries.
Build contact synchronization
Design a contact synchronization workflow for these source fields: [fields]. Include search, create, update, batching, pagination, and partial-failure handling.
Implement secure webhooks
Create an Express HubSpot webhook handler. Verify signature v3 using the raw body, method, URI, and timestamp. Add replay protection and queuing.
Architect a multi-account integration
Design a multi-account HubSpot integration for [requirements]. Cover OAuth state, token rotation, scopes, associations, custom objects, throttling, observability, and recovery.
Best Practices
- Request only required HubSpot scopes and keep tokens in a managed secret store.
- Implement cursor pagination, bounded retries, and rate-limit backoff for every list or bulk workflow.
- Validate OAuth state and HubSpot webhook v3 signatures against raw request data before processing.
Avoid
- Do not hardcode private app tokens, OAuth client secrets, or access tokens.
- Do not process webhook payloads before authenticating the signature and checking timestamp freshness.
- Do not issue unbounded parallel requests or ignore pagination and partial batch failures.
Frequently Asked Questions
Does this skill execute HubSpot requests?
No. It provides implementation patterns that require your credentials, application code, permissions, and testing.
Should I use OAuth or a private app token?
Use OAuth for multiple customer accounts. Use a private app token for one controlled HubSpot account.
Which SDKs are covered?
The examples primarily use the HubSpot Node.js SDK and include a limited Python authentication example.
Does it cover webhook security?
It discusses signatures and replay checks, but the included v3 verification example needs correction before production use.
Can it define HubSpot custom objects?
Yes. It covers schema creation and record operations, subject to HubSpot Enterprise limits and permissions.
Does it handle rate limits and pagination?
It provides patterns for cursor pagination, batching, delays, and retry handling. Production systems still need monitoring and bounded retries.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/hubspot-integrationRef
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Maintenance freshness
7/26/2026
Usage
9 downloads · 188 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-architect
81Review Architecture Workflows and Project Paths
Architecture reviews need a consistent starting point and clear project boundaries. This skill provides workspace-scoped tool templates, command examples, and generic design references.
Coding & Development View
📦
senior-fullstack
81Review Fullstack Project Foundations
Fullstack project setup can require many tools and checks. This skill provides basic local wrappers, common commands, and general engineering guidance.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
firecrawl-build-scrape
82Build Firecrawl Single-Page Scraping
by firecrawl
Apps often need clean content from one known URL. This skill guides a focused Firecrawl /scrape integration for page extraction.
Coding & Development View
📦
firecrawl-build-interact
82Build Firecrawl Browser Interactions
by firecrawl
Dynamic pages often hide data behind clicks, forms, and login flows. This skill helps teams choose and scope Firecrawl /interact integrations.
Coding & Development View
📦
lark-skill-maker
81Create Reusable Lark CLI Skills
by larksuite
Building reusable Lark automation requires consistent API research, permissions, and workflow documentation. This skill guides Claude and Codex through focused lark-cli skills for single APIs or multi-step workflows.
Coding & Development View
📦
extension-http-outcalls
80Build Backend HTTP Outcalls in Motoko
by caffeinelabs
Backend canisters need a reliable way to call external APIs. This skill shows how to use the Caffeine AI outcall module for GET and POST requests.
Coding & Development View
📦
sent-integration-starter
80Build a Reliable Sent Integration
by sentdm
Messaging integrations can fail through duplicate sends, unsafe retries, weak webhook validation, or incorrect credential scope. This skill provides a staged Sent v3 implementation and launch review.
Coding & Development View
📦
rn-auth
78Implement Expo Authentication Flows
by CJHarmath
Expo authentication often fails because OAuth redirects, token storage, and route guards must align across app and backend. This skill provides concrete React Native patterns for Google sign-in, secure token handling, protected routes, and backend token verification.
Coding & Development View