Lemlist

PassAudited by ClawScan on May 13, 2026.

Overview

This is a coherent ClawLink-based Lemlist integration, but it can access and change outreach account data after you connect Lemlist.

Install this only if you want to manage Lemlist through ClawLink. Verify the ClawLink plugin, connect the correct Lemlist account, do not paste raw credentials into chat, and carefully review any preview before approving lead, campaign, sequence, bulk, or external-facing changes.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You must trust and install the ClawLink plugin for the skill to work.

Why it was flagged

The skill depends on an external plugin that is not part of this artifact set. The install step is disclosed and central to the stated ClawLink integration.

Skill content

Install the verified ClawLink plugin: `openclaw plugins install clawhub:clawlink-plugin`

Recommendation

Install the plugin only from the expected ClawHub source and review ClawLink verification/docs if you are unsure.

Note

ASI03: Identity and Privilege Abuse

What this means

Connecting ClawLink and Lemlist grants the integration delegated access to your outreach account.

Why it was flagged

The skill requires account pairing and a persistent local device credential, but it discloses where the credential is stored and limits its use to ClawLink.

Skill content

The resulting device credential is stored locally in OpenClaw's plugin config and is only sent to `claw-link.dev`. The user should not paste raw credentials into chat.

Recommendation

Use the intended Lemlist account, review requested permissions during connection, and revoke the connection if you no longer need it.

Note

ASI02: Tool Misuse and Exploitation

What this means

Approved actions could modify leads, campaigns, sequences, or outreach activity in Lemlist.

Why it was flagged

The skill can perform business-impacting Lemlist write actions, including campaign and lead changes, but the instructions require confirmation for those actions.

Skill content

Create or update leads after confirmation; Manage campaign state and related outreach operations carefully; Confirm before bulk outreach or sequence changes

Recommendation

Review previews carefully and approve only the specific writes, bulk changes, or outreach actions you intended.