Unloopa Api
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill is coherent with its stated Unloopa sales-automation purpose, but it can automatically email or call many businesses and perform account-changing actions without clear confirmation safeguards.
Install only if you intentionally want an agent to use Unloopa for automated cold outreach. Before use, verify the provider, set low lead limits, require manual approval before emails, calls, purchases, or campaign activation, and monitor credits, billing, and API-key access.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A single broad request could cause the agent to generate leads and send unsolicited outreach emails at scale, creating reputational, compliance, or account-risk consequences.
This documents a chained automatic workflow that reaches out to third parties, rather than a reviewed step-by-step process with explicit approval before sending.
The `/command` endpoint runs the **entire pipeline automatically**: scrape leads → generate websites → enrich emails → send outreach.
Require explicit user confirmation before sending outreach, preview recipients and templates, set a small `max_results`, and disable automatic sends unless the user clearly asks for them.
The agent could spend credits or make account changes through the user's Unloopa account if the workflow proceeds too aggressively.
The provider API key is used for account-level operations, and the workflow includes buying phone numbers without a visible instruction to obtain explicit user approval first.
Every request needs the header: `Authorization: Bearer $UNLOOPA_API_KEY` ... If empty → POST /phone-numbers/search + POST /phone-numbers/buy
Use the least-privileged key available, monitor quotas and billing, and require explicit approval for any purchase, phone-number provisioning, campaign activation, or call.
A mistaken niche, location, or lead count could propagate into many generated assets and outreach messages before the user notices.
One natural-language command can fan out into many downstream actions across lead scraping, website generation, enrichment, and email sending; the provided artifact is truncated before showing any containment safeguards.
`max_results` (optional, 1-100, default: **100**) ... scrapes up to `max_results` leads (default 100), generates a website for each, finds email addresses, enriches social profiles, and sends outreach emails
Make the lead count explicit, require approval between stages, and provide clear cancellation or rollback steps for jobs and queued outreach.
Users must trust the external Unloopa service and domain before granting API access.
The artifact does not provide a source repository or homepage for users to independently verify the provider, although the skill requires a live service API key.
Source: unknown; Homepage: none
Verify the service domain and vendor independently, review account terms and billing behavior, and revoke the key if it is no longer needed.