Skills hubspot-integration
📦

hubspot-integration

Content revision r2 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Build Secure HubSpot CRM Integrations

HubSpot integrations require careful authentication, object handling, pagination, and webhook processing. This skill provides practical Node.js and Python patterns for common CRM workflows.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "hubspot-integration" from https://skillstore.io/skills/sickn33-hubspot-integration.md and its manifest at https://skillstore.io/api/skills/sickn33-hubspot-integration/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-hubspot-integration.md Signed manifest GET /api/skills/sickn33-hubspot-integration/manifest Signed lockfile GET /api/skills/sickn33-hubspot-integration/lockfile

Test it

Using "hubspot-integration". Create a private app contact reader with pagination.

Expected outcome:

A Node.js implementation plan that loads a named token, requests selected properties, follows cursors, and retries bounded rate-limit responses.

Using "hubspot-integration". Review my HubSpot webhook endpoint.

Expected outcome:

A security checklist covering raw-body preservation, signature v3 inputs, timing-safe comparison, timestamp freshness, fast responses, and asynchronous event processing.

Using "hubspot-integration". Plan a project custom object linked to contacts and companies.

Expected outcome:

A schema plan with required properties, field types, supported associations, record operations, search behavior, and Enterprise subscription constraints.

Security Audit

High Risk
v5 • 7/24/2026 Open versioned report

The static findings are false positives involving expected HubSpot API requests, scoped environment variables, JavaScript interpolation, and CRM identifier mapping. However, the OAuth example omits state validation, and the webhook example does not implement HubSpot signature v3 correctly.

1
Files scanned
837
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:36-47
OAuth State Validation Is Missing
The authorization URL omits a random state parameter, and the callback exchanges a code without validating state. This permits OAuth login CSRF or account misbinding.
The complete authorization URL and callback example shows no state generation, session binding, or validation.
High
SKILL.md:480-518
HubSpot Signature v3 Verification Is Incorrect
The handler reads the v3 header but verifies a hex HMAC over only the serialized body. HubSpot v3 requires additional request data, Base64 output, and timing-safe comparison.
The example explicitly reads the v3 signature and timestamp, but the HMAC covers only JSON.stringify(req.body) and uses direct string equality.

Risk Factors

⚙️ External commands (1)
SKILL.md:554
🌐 Network access (5)
SKILL.md:47 SKILL.md:74 SKILL.md:38 SKILL.md:47 SKILL.md:74
🔑 Env variables (19)
SKILL.md:31 SKILL.md:32 SKILL.md:33 SKILL.md:114 SKILL.md:169 SKILL.md:263 SKILL.md:360 SKILL.md:505 SKILL.md:581 SKILL.md:31 SKILL.md:32 SKILL.md:33 SKILL.md:114 SKILL.md:169 SKILL.md:263 SKILL.md:360 SKILL.md:505 SKILL.md:581 SKILL.md:144
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-hubspot-integration/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-hubspot-integration/security.svg)](https://skillstore.io/skills/sickn33-hubspot-integration?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-hubspot-integration?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-hubspot-integration/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-hubspot-integration.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). hubspot-integration security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-hubspot-integration/audits/5

BibTeX citation

@techreport{sickn33-sickn33-hubspot-integration-2026, author = {sickn33}, title = {hubspot-integration security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-hubspot-integration/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "hubspot-integration security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-24" url: "https://skillstore.io/skills/sickn33-hubspot-integration/audits/5" identifiers: - type: other value: "skillstore:sickn33-hubspot-integration:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
70
Community
74
Spec Compliance

What You Can Build

Synchronize CRM contacts

Design contact creation, updates, searches, pagination, and batches for an application integration.

Configure an internal CRM connection

Plan a private app integration with scoped access, token handling, associations, and rate-limit controls.

Review webhook ingestion

Assess signature verification, replay protection, response timing, and queued event processing before deployment.

Try These Prompts

Connect a private app 
Create a Node.js HubSpot private app client using an environment variable. Add paginated contact retrieval and bounded rate-limit retries.
Build contact synchronization 
Design a contact synchronization workflow for these source fields: [fields]. Include search, create, update, batching, pagination, and partial-failure handling.
Implement secure webhooks 
Create an Express HubSpot webhook handler. Verify signature v3 using the raw body, method, URI, and timestamp. Add replay protection and queuing.
Architect a multi-account integration 
Design a multi-account HubSpot integration for [requirements]. Cover OAuth state, token rotation, scopes, associations, custom objects, throttling, observability, and recovery.

Best Practices

  • Request only required HubSpot scopes and keep tokens in a managed secret store.
  • Implement cursor pagination, bounded retries, and rate-limit backoff for every list or bulk workflow.
  • Validate OAuth state and HubSpot webhook v3 signatures against raw request data before processing.

Avoid

  • Do not hardcode private app tokens, OAuth client secrets, or access tokens.
  • Do not process webhook payloads before authenticating the signature and checking timestamp freshness.
  • Do not issue unbounded parallel requests or ignore pagination and partial batch failures.

Frequently Asked Questions

Does this skill execute HubSpot requests?
No. It provides implementation patterns that require your credentials, application code, permissions, and testing.
Should I use OAuth or a private app token?
Use OAuth for multiple customer accounts. Use a private app token for one controlled HubSpot account.
Which SDKs are covered?
The examples primarily use the HubSpot Node.js SDK and include a limited Python authentication example.
Does it cover webhook security?
It discusses signatures and replay checks, but the included v3 verification example needs correction before production use.
Can it define HubSpot custom objects?
Yes. It covers schema creation and record operations, subject to HubSpot Enterprise limits and permissions.
Does it handle rate limits and pagination?
It provides patterns for cursor pagination, batching, delays, and retry handling. Production systems still need monitoring and bounded retries.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/hubspot-integration

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

9 downloads · 188 views

File structure

📄 SKILL.md