Lead Outreach CRM
v1.0.0Track leads locally, manage outreach campaigns, and export as CSV for download.
⭐ 0· 81·0 current·0 all-time
bypbopps@3rdbrain
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (local lead tracking, outreach sequences, CSV export) match the code and SKILL.md. The code implements lead scoring, outreach template generation, saving/loading leads to a local JSON file, and CSV export — all expected for a local CRM skill.
Instruction Scope
Runtime instructions are limited to running the provided Node CLI and working with files in the agent workspace (/root/.openclaw/workspace by default). The SKILL.md does not instruct reading unrelated system files or sending data to external endpoints. Note: the skill writes lead data to the agent workspace, so exported/stored leads (which may include PII) reside in container storage until removed.
Install Mechanism
No install spec — instruction-only with a single JS file and package.json. Nothing is downloaded or written during install from external URLs.
Credentials
The skill declares no required credentials or env vars, which matches its local-only behavior. The code reads OPENCLAW_WORKSPACE (process.env.OPENCLAW_WORKSPACE) as an override for workspace location; this env var is not listed in SKILL.md's 'requires' but its use is low-risk and limited to where data is stored.
Persistence & Privilege
The skill does not request always: true and does not modify other skills. It persists data only to its workspace files (leads.json, leads.csv), which is expected for a local CRM.
Assessment
This skill appears to do exactly what it says: store leads locally and export CSVs. Before installing, consider: (1) Stored leads live in the agent workspace (/root/.openclaw/workspace by default) — don't store sensitive PII there unless you're comfortable with that storage. (2) You can change the workspace path with OPENCLAW_WORKSPACE if needed (the code reads that env var). (3) There is no external sync in the code you reviewed (CRM sync is noted as a paid-plan placeholder), but if you rely on off-box sync, verify any additional paid-plan code. (4) Use the 'clear' command carefully — it deletes local leads. If you need higher assurance, review the full JS file (CLI handlers) before use or run in an isolated environment.Like a lobster shell, security has layers — review code before you run it.
latestvk974zvmv1r8zf5qp1xfev3ttq983bs6d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.