Lead Radar — 9 Platforms Scanned Daily for Warm Leads

Every morning, scans Reddit, Hacker News, Indie Hackers, Stack Overflow, Quora, Hashnode, Dev.to, GitHub, and Lobsters for people actively asking for what yo...

Security Scan

The skill appears to do what it claims (scan public sites and send leads to Telegram), but there are several implementation and metadata inconsistencies and a notable privacy/control risk around the license server providing a Gemini API key — review before installing.

Purpose & Capability

The code, SKILL.md, and manifest align with the advertised purpose: scanning public platforms, scoring posts, deduplicating, and sending results to Telegram. Required inputs (OFFER_DESCRIPTION, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, LEAD_RADAR_LICENSE_KEY) are appropriate for functionality. However, registry metadata claims 'no install spec / instruction-only' while SKILL.md includes an install command and there are many source files — this metadata mismatch is confusing and worth verifying.

Instruction Scope

The runtime instructions and code send scraped post content and your OFFER_DESCRIPTION to the Gemini model for scoring (lib/intentScorer.js calls Google's generative API). The code also communicates with a license server (lib/licenseCheck.js) that can return and inject a GEMINI_API_KEY into the environment. That means third-party-owned license infrastructure can influence model access and can indirectly enable remote-controlled model usage. The SKILL.md partially documents outbound calls but the license-check details are truncated; you should inspect lib/licenseCheck.js to see exactly what data it transmits and to which endpoint before trusting it.

Install Mechanism

Installation is via npm (SKILL.md: "npm install" / package.json). Dependencies are standard (node-fetch, dotenv) but include better-sqlite3 (native module with install/build steps). No arbitrary binary downloads or obscure URLs were observed in provided files. Installing will run npm install which may compile native code — test in a safe environment if you have build restrictions.

Credentials

The skill requires sensitive values: TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID (expected) and a paid LEAD_RADAR_LICENSE_KEY. Unexpectedly, the runtime obtains and injects a GEMINI_API_KEY from the license check rather than asking the user for an AI key. That gives the license server operator indirect control over model usage and means prompts (offer description and scraped posts) will be sent to Google using a third-party-supplied key. GEMINI_API_KEY is not declared as a user-provided config variable in the SKILL.md, which obscures this behavior.

Persistence & Privilege

The skill persists deduplication state via a local SQLite DB (better-sqlite3). It does not request forced 'always' installation and does not appear to modify other skills or global agent settings. Local persistence for dedup is proportionate to the functionality, but note it creates on-disk state.

What to consider before installing

What to check before installing - Review lib/licenseCheck.js before installing or providing a license key: confirm exactly what it sends to the license server (does it transmit OFFER_DESCRIPTION, message content, or other system info?) and which domain it contacts (SKILL.md mentions lead-radar.pro). If the license server receives your OFFER_DESCRIPTION or sample leads, consider privacy implications. - Understand model key ownership: the skill injects a GEMINI_API_KEY returned by the license server and then calls the Google generative API from your machine. That means a third party controls the API key (and could revoke or throttle it) and your prompts/post content are sent to Google under that key. If you need assurance that prompts are billed/controlled by you, request a mode that accepts your own Gemini/API key instead. - Sensitive tokens: TELEGRAM_BOT_TOKEN is required and grants the skill ability to send messages as your bot. Only provide it if you trust the author. Use a bot account with limited scope if possible. - Install in a sandbox first: npm install will build native modules (better-sqlite3). If you run this on a production machine, consider running it in an isolated environment or container. - Audit license/server endpoints and privacy policy: the SKILL.md links (lead-radar.pro, stripe) suggest commercial hosting; verify the vendor, privacy policy, and what telemetry/data they collect before subscribing. - If you want to proceed but remain cautious: ask the maintainer for (1) the full text of lib/licenseCheck.js and the license server URL, (2) an option to supply your own Gemini API key, and (3) a description of retention/processing of any data sent off-machine. If those answers are unsatisfactory, classify the skill as untrusted and do not provide tokens or license keys.

Lead Radar

Stop cold outreach. Start warm conversations.

Lead Radar scans 9 social platforms every morning for people actively asking for what you sell — then delivers the top 10 buying-intent leads straight to your Telegram, each with a pre-drafted reply ready to send.

How It Works

1. You describe your offer — e.g. "I sell a CRM for freelance designers"
2. Gemini 2.5 Flash generates smart keywords tailored to your niche
3. 9 sources are scanned for posts matching those keywords (Reddit, Hacker News, Indie Hackers, Stack Overflow, Quora, Hashnode, Dev.to, GitHub Discussions, and Lobsters)
4. Each post is scored 0-10 for buying intent using AI — filtering out noise and keeping only real opportunities
5. Top 10 leads are delivered to Telegram every morning at 8am, each with:
   • The original post title and snippet
   • A direct link to the conversation
   • An intent score with explanation
   • A pre-drafted reply you can copy-paste

What Gets Detected

Lead Radar finds posts like:

• "Looking for a tool that does X" — direct buying intent
• "How do you handle Y?" — pain point that your product solves
• "We switched from Z and need an alternative" — active comparison shopping
• "Any recommendations for...?" — open to suggestions

Sources

Platform	Method
Reddit	API with automatic fallback chain (3 strategies)
Hacker News	Algolia search API
Indie Hackers	Jina web scraping
Stack Overflow	Public API
Quora	Jina web scraping
Hashnode	GraphQL API
Dev.to	Public API
GitHub Discussions	REST API
Lobsters	JSON feeds with local filtering

Source Health Monitoring

If any source goes down (rate-limited, blocked, or temporarily unavailable), Lead Radar:

• Continues scanning all other sources normally
• Appends a warning to your Telegram message listing which sources are down
• Shows scan stats: how many posts were scanned across how many active sources

Smart Pre-Filtering

Before running AI scoring, Lead Radar pre-filters posts by keyword relevance. This means only genuinely relevant posts get scored, keeping the pipeline fast (under 60 seconds). AI scoring is included in your subscription — no separate API key needed.

Setup (2 minutes)

1. Get a License Key

Visit lead-radar.pro and start your 3-day free trial ($9/month after). Your key will be emailed to you instantly.

2. Create a Telegram Bot

Open Telegram, search for @BotFather, send /newbot, and follow the prompts. Copy the bot token it gives you (looks like 123456:ABC-DEF...).

3. Get Your Telegram Chat ID

Search for @userinfobot in Telegram, send it any message — it replies with your Chat ID (a number like 123456789). Copy it.

4. Fill in Your Settings

After installing the skill in OpenClaw, go to Lead Radar settings and enter:

Field	What to enter
LEAD_RADAR_LICENSE_KEY	Your license key from step 1
TELEGRAM_BOT_TOKEN	The bot token from step 2
TELEGRAM_CHAT_ID	Your chat ID from step 3
OFFER_DESCRIPTION	Describe what you sell in 1-2 sentences (e.g. "I sell a CRM for freelance designers")

No AI API keys needed — Gemini scoring is included in your subscription.

5. Wait for 8am

Lead Radar scans automatically every morning at 8am. Your first leads will arrive in Telegram tomorrow.

Pricing

• 3-day free trial — full access, no credit card charge
• $9/month — cancel anytime from your billing portal

FAQ

How many leads will I get per day? It depends on your niche. Most users see 3-10 warm leads daily. Broader niches (like "project management") get more; narrow niches (like "CRM for pet groomers") get fewer but higher quality.

Can I customize the scanning time? The default is 8am daily. You can change the cron schedule in your OpenClaw config.

What if Reddit blocks my IP? Lead Radar has a 3-strategy fallback chain for Reddit. If one method gets blocked, it automatically switches to the next. Source health monitoring will notify you in Telegram if any source goes down.

What data leaves my machine? Lead Radar executes on your machine via OpenClaw but relies on external services to function. Here is every outbound call it makes:

• Source platforms — fetches publicly available posts from Reddit (old.reddit.com, Pullpush.io), Hacker News (Algolia API), Indie Hackers & Quora (via r.jina.ai proxy), Stack Overflow (Stack Exchange API), Hashnode (GraphQL API), Dev.to (public API), GitHub (REST API), and Lobsters (JSON feeds). These are read-only requests; no user credentials or personal data are included in these calls.
• License server — validates your LEAD_RADAR_LICENSE_KEY and returns a vendor-provided GEMINI_API_KEY (users do not need their own). Only your license key is transmitted; your OFFER_DESCRIPTION is not sent to the license server.
• Google Gemini API — sends post snippets and your OFFER_DESCRIPTION to Google's generative AI for intent scoring, using the vendor-provided API key. This means your offer description and scraped post content are processed by Google under the vendor's API account.
• Telegram API — sends your daily lead digest to your chat via your TELEGRAM_BOT_TOKEN No data is stored on any remote server by the skill itself. Your OFFER_DESCRIPTION and post snippets are sent to Google Gemini for scoring but are not persisted by Lead Radar.

By installing and running Lead Radar, you consent to: your OFFER_DESCRIPTION and publicly scraped post snippets being sent to Google's Gemini API for scoring; your license key being validated against our license server each run; and your lead digest being sent to the Telegram API. All four required secrets (license key, bot token, chat ID, offer description) are stored locally in your OpenClaw environment and are only transmitted to the services described above.