Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add meticulosity/hubspot-workflow-documenter --skill hubspot-workflow-documentergit clone --depth 1 https://github.com/meticulosity/hubspot-workflow-documenterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/meticulosity/hubspot-workflow-documenter/hubspot-workflow-documenter)<a href="https://agentmods.dev/skills/meticulosity/hubspot-workflow-documenter/hubspot-workflow-documenter"><img src="https://agentmods.dev/badge/skills/meticulosity/hubspot-workflow-documenter/hubspot-workflow-documenter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/meticulosity/hubspot-workflow-documenter/hubspot-workflow-documenter"><img src="https://agentmods.dev/badge/skills/meticulosity/hubspot-workflow-documenter/hubspot-workflow-documenter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00541 |
| Opus 5 | $0.00026 | $0.00270 |
| Sonnet 5 | $0.00010 | $0.00108 |
| Haiku 4.5 | $0.00005 | $0.00054 |
Grade A, and why
hubspot-workflow-documenter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HubSpot Workflow Documenter
Reads a HubSpot portal's workflows and writes documentation for them: what each one does in plain English, a Mermaid diagram of its logic, and a severity-ranked list of what is broken.
This skill only ever reads. It never creates, edits or deletes anything in the portal.
Before you run it
The agency needs a HubSpot private app token in the client's portal. Point them
at SETUP.md, which lists the exact scopes and explains why none of them can be
read-only. Then:
export HUBSPOT_TOKEN='pat-na1-...'
PYTHONPATH=src python3 -m workflow_documenter --out output/portal.md
To show somebody the output before any access is granted:
PYTHONPATH=src python3 -m workflow_documenter --dry-run --out output/sample.md
Generated documents contain the client's workflow names and internal structure,
so they belong in output/, which is git-ignored.
That renders from bundled fixtures and opens no network connection.
If the client will not grant API access at all, export what you can and use
--from-dir ./export. Say plainly that a file-mode run is a thinner analysis.
Reading the output
The document has four sections. Findings is the one that matters: it is sorted worst first, where "worst" means most able to reach a real person right now. A defect in a disabled workflow ranks below the same defect in a live one.
Lead with anything under Critical. Overlapping enrolment sits there because two live workflows triggered by the same form catch the same contact twice, which is the usual cause of duplicate emails and is invisible in the HubSpot UI.
Things to tell the client honestly
- Webhook URLs are redacted by default because they are credentials. Only pass
--include-webhook-urlsif the document is going somewhere private. - If a scope is missing the run still produces a document, with the unresolved names labelled. It does not fail.
- HubSpot has no read-only scope for workflows, so the token can technically
write. This tool cannot: every call it makes is a GET, and
tests/test_no_writes.pyproves it mechanically.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 59 lines · 51 tokens per session scan A 0c61a2d90735
hubspot-workflow-documenter is a skill published in the GitHub repository meticulosity/hubspot-workflow-documenter (2 stars, last pushed 1mo ago), licensed MIT. It adds 51 tokens to every session and 541 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Documentation Gap Finder
Audits a codebase or docs folder and lists everything that is undocumented, outdated, or unclear.
skill-builder
Automatically detect source types and build AI skills using Skill Seekers. Use when the user wants to create skills from documentation, repos, PDFs, videos, or other knowledge sources.
skill-builder
Automatically detect source types and build AI skills using Skill Seekers. Use when the user wants to create skills from documentation, repos, PDFs, videos, or other knowledge sources.
Vulnerability Scanning & Assessment
Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting.
GRC & Compliance
Governance, risk, and compliance — risk assessment and scoring, control mapping across NIST CSF 2.0 / ISO 27001:2022 / SOC 2 / CIS Controls v8, gap analysis, audit evidence preparation, and security policy generation.
han-release
Cut a Han release: update CHANGELOG.md with the changes since the last release, bump and tag every plugin that changed as {plugin-name}--v{version} so a version-constrained dependency can resolve, and publish a GitHub release crediting every merged pull request and closed issue to the people behind it. Use when…