Is hubspot-api safe?
https://clawhub.ai/byungkyu/hubspot-api
This skill is a documentation-only HubSpot CRM integration that routes all API traffic through a third-party proxy (gateway.maton.ai). While it contains no malicious code execution vectors and passed clone-time monitoring cleanly, the fundamental architecture requires full trust in Maton's infrastructure — they hold the real OAuth tokens and can observe all CRM data in transit. The skill also promotes installation of a companion api-gateway skill, expanding the trust perimeter. Users should understand they are granting a third party full access to their HubSpot CRM data.
Category Scores
Findings (11)
HIGH All traffic proxied through third-party gateway -25 ▶
Every HubSpot API call is routed through gateway.maton.ai rather than directly to api.hubapi.com. This third-party proxy has full visibility into all CRM data including contacts, companies, deals, and their properties. The proxy also holds the real OAuth token, meaning users never control their own HubSpot credentials — Maton does. This creates a single point of trust and a potential data collection vector.
MEDIUM API key sent to third-party on every request -10 ▶
The MATON_API_KEY environment variable is transmitted to Maton's infrastructure (gateway.maton.ai and ctrl.maton.ai) as a Bearer token on every API call. This key grants full access to the user's Maton account and all connected HubSpot instances.
MEDIUM Cross-skill promotion to api-gateway -18 ▶
The skill description explicitly directs the agent to use another skill ('api-gateway') for non-HubSpot tasks. This is a form of cross-skill influence that could cause the agent to install or invoke additional third-party skills without explicit user intent, expanding the attack surface.
MEDIUM Executable code blocks embedded in documentation -12 ▶
The SKILL.md contains numerous ready-to-execute Python heredoc blocks. When injected into an agent's system prompt, a compliant agent may execute these code blocks directly when asked to 'list contacts' or 'create a connection,' without the user explicitly requesting code execution. The pattern uses python <<'EOF' which is immediately executable in bash.
LOW Troubleshooting instructs echoing API key -8 ▶
The troubleshooting section instructs the agent to run 'echo $MATON_API_KEY' to verify the key is set. If the agent follows this instruction, the API key would be displayed in plaintext in the conversation, potentially exposing it in logs, screenshots, or shared sessions.
LOW Connection management exposes OAuth session tokens -5 ▶
The 'Create Connection' flow returns a URL containing a session_token parameter. If the agent displays this URL, it could be captured by observers. The connection management API at ctrl.maton.ai also provides metadata about all active OAuth connections.
MEDIUM Batch delete operations risk CRM data loss -15 ▶
The skill documents batch archive/delete operations that can remove up to 100 records per request. An agent following instructions could inadvertently delete large amounts of CRM data. While HubSpot has 90-day soft-delete recovery, this still poses operational risk.
MEDIUM Opaque proxy could modify API responses -15 ▶
Since Maton's gateway sits between the agent and HubSpot, it could theoretically inject, modify, or filter API responses. Users have no way to verify response integrity. A compromised or malicious gateway could return manipulated CRM data.
LOW Cross-skill chaining expands attack surface -15 ▶
If a user installs both this skill and the referenced api-gateway skill, the combined surface area allows the agent to interact with multiple third-party APIs through Maton's proxy, significantly increasing the potential for data exposure or unintended actions.
INFO Standard VM bootstrap filesystem access -5 ▶
Filesystem monitoring shows access to .env, .aws/credentials, and SSH host keys, but these are consistent with the VM execution environment's bootstrap process (sshd, wireplumber, openclaw agent init) rather than skill-initiated access. No skill-specific filesystem anomalies detected.
INFO No install-time code execution 0 ▶
The skill contains no package.json scripts, git hooks, gitattributes filters, submodules, or symlinks. Installation is purely file copy with no code execution.