Lead Enrichment Skill

PassAudited by ClawScan on May 12, 2026.

Overview

This appears to be a coherent Prismfy-powered lead-enrichment skill, with expected API-key use and optional persistent reminders that users should understand before enabling.

This skill is reasonable to install if you intend to use Prismfy for lead enrichment. Before using it, protect your PRISMFY_API_KEY, avoid submitting sensitive or confidential lead data unless appropriate, and only enable the optional hook if you want a persistent OpenClaw reminder for this workflow.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your Prismfy API key is used by the helper and should be treated like a password for your Prismfy account or quota.

Why it was flagged

The helper sends the Prismfy API key as a bearer token to the configured Prismfy quota endpoint. This is expected for the service integration, but it is sensitive credential use.

Skill content
curl -fsS -H "Authorization: Bearer $PRISMFY_API_KEY" "$ME_URL"
Recommendation

Only set PRISMFY_API_KEY in trusted environments, avoid sharing logs or shell history containing it, and verify any custom PRISMFY_API_ROOT, PRISMFY_API_URL, or PRISMFY_ME_URL values before use.

What this means

Lead details you ask the skill to enrich may be sent to Prismfy for search processing.

Why it was flagged

Lead-enrichment searches are sent to an external provider endpoint. This is disclosed and purpose-aligned, but submitted company, person, role, geo, and ICP query details may leave the local environment.

Skill content
API_URL="${PRISMFY_API_URL:-https://api.prismfy.io/v1/search}"
Recommendation

Do not submit confidential lead lists, private customer data, or sensitive personal data unless you are comfortable with Prismfy processing those queries under its terms.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If enabled, future agent sessions may be reminded to use this lead-enrichment workflow for relevant tasks.

Why it was flagged

If the optional hook is installed and enabled, it injects a reminder into future agent bootstrap context. The reminder is scoped to lead enrichment and disclosed in the README, but it is persistent agent-context modification.

Skill content
if (event.type !== "agent" || event.action !== "bootstrap") return; ... event.context.bootstrapFiles.push({ path: "LEAD_ENRICHMENT_REMINDER.md", content: REMINDER_CONTENT, virtual: true })
Recommendation

Enable the hook only if you want this persistent reminder behavior; otherwise use the skill manually without copying it into ~/.openclaw/hooks.