Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Lead Generation Pipeline
v1.0.0Autonomous 6-agent pipeline that researches industries, finds businesses, and generates personalized outreach — one API call.
⭐ 0· 34·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md is an API-style spec for an external lead-generation service — that aligns with the name/description. However the skill advertises an 'autonomous 6-agent pipeline' but provides no code (it relies on an external gateway), and it requires payment for endpoints even though the registry metadata declares no required credentials or primary credential. That mismatch between 'requires payment' and 'no declared auth' is an incoherence.
Instruction Scope
The instructions only describe calling external endpoints; they do not instruct reading local files or environment variables. However the pipeline expects and returns potentially sensitive personal contact data (emails, phones) and research summaries — so using it will transmit business/people data to the external gateway. The SKILL.md does not specify what input is sent, nor any redaction/privacy behavior.
Install Mechanism
Instruction-only skill with no install spec and no bundled code. This minimizes local install risk because nothing is written or executed locally by the skill itself.
Credentials
No environment variables or credentials are declared, yet the documentation states that all endpoints 'require x402 payment (USDC on Base L2)'. There is no explanation of how payment/auth is provided (wallet signing, API key, OAuth, on-chain callback), which is a material omission. The skill also will cause external transmission of lead/contact data — the privacy implications are not documented.
Persistence & Privilege
always is false and the skill does not request persistent privileges. It does allow autonomous invocation (platform default), which increases blast radius if the external service is untrusted, but that's expected for skills and not a standalone disqualifier.
What to consider before installing
This skill points your agent at an external paid API that returns personal contact data. Before installing, get answers to: (1) Who operates https://gateway.mcfagentic.com? Is there a verifiable homepage, company, or privacy policy? (2) Exactly how is the x402 payment supplied and authorized — does the gateway require you to expose wallet private keys or sign requests client-side? (3) What are the terms of use and data retention/privacy policies — will lead/contact data be stored, shared, or resold? (4) Can you test with non-sensitive inputs and a single free call to confirm behavior? If you cannot verify the operator, payment/auth mechanism, and privacy terms, avoid enabling autonomous invocation and do not provide any PII or private customer data to the skill. Consider invoking the API yourself from a controlled environment (so you control payment and logging) rather than giving the skill direct access.Like a lobster shell, security has layers — review code before you run it.
latestvk970110qpfafd0ktm635dnq8ax8407k0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.