Email Outreach Automation

Cold email outreach pipeline with multi-step sequences, reply tracking, bounce handling, and campaign analytics. 4 production-ready n8n workflows with Google...

Security Scan

The package is internally consistent (n8n workflows that match the description) but contains operational security gaps — notably an unauthenticated reply webhook and weak/implicit secret handling — that could be abused if deployed without changes.

Purpose & Capability

Name/description match the assets: four n8n workflow JSON files implement import, sequenced sends, reply tracking, and daily reports. Declared n8n credentials (Google Sheets + SMTP) are exactly what the workflows use.

Instruction Scope

Workflows instruct n8n to expose two public webhooks. The import webhook requires a _secret in the request body and compares it to $env.OUTREACH_SECRET (or a literal fallback). The reply webhook accepts POSTs with just an email and will mark prospects as replied with no authentication. This allows unauthenticated callers to spoof replies (affecting campaign state/metrics) and could be used to manipulate data. The import webhook places the secret in the request body (which may be logged) and relies on a simple equality check; if OUTREACH_SECRET is unset the comparison falls back to a literal placeholder, which could create accidental behavior. The SKILL.md is otherwise precise about required placeholders and credentials.

Install Mechanism

Instruction-only skill with no install steps and no code to write to disk. This minimizes supply-chain risk; the provided workflow JSON files are static and behave as described.

Credentials

Only two environment variables are required (OUTREACH_SECRET, OUTREACH_ADMIN_EMAIL) and they are used by the workflows. n8n credential references (Google Sheets and SMTP credential IDs) are present inside workflows and documented in SKILL.md. This is proportionate. Note: use of a fallback string ('YOUR_NOTIFICATION_EMAIL' / 'YOUR_OUTREACH_SECRET') in templates can cause accidental misrouting or unexpected behavior if env vars are not set.

Persistence & Privilege

Skill is not always-enabled and does not request persistent platform privileges or modify other skills. It only supplies workflows to be imported into n8n.

What to consider before installing

This package appears to be what it claims (n8n workflows for cold outreach) but you should not deploy it verbatim to production. Before installing or using: - Require authentication on both webhooks. At minimum add the same OUTREACH_SECRET check to the reply webhook or require a signature/header; avoid trusting unauthenticated POSTs. - Avoid placing secrets in request bodies; prefer an Authorization header or signed webhook. Ensure OUTREACH_SECRET is set in your environment (and not left as the example placeholder). - Use a dedicated sending domain and credentials for SMTP and monitor bounce handling to avoid deliverability and reputation issues. - Confirm Google Sheet IDs and credential IDs are private and that the Sheets permissions are limited. - Add rate-limiting / IP allowlist for webhooks if possible to reduce abuse. - Be aware of legal obligations for cold emailing (CAN-SPAM, GDPR, local rules) and get consent where required. If you want, I can suggest concrete code changes to add webhook authentication and safer secret handling in the workflows.

A complete cold email outreach pipeline built on n8n and Google Sheets. Import prospects, run multi-step email sequences, track replies, and get daily campaign reports.

Problem

Cold email outreach requires consistent followup sequences, reply detection, and status tracking across hundreds of prospects. Most tools charge $50-200/month per seat and lock you into their platform.

This system provides a free, self-hosted outreach pipeline with full control over your data and sending.

What It Does

1. Prospect Import — Webhook API to import prospects (single or batch) with validation and deduplication
2. Email Sequences — 4-step automated outreach: initial, follow-up 1 (Day 3), follow-up 2 (Day 7), breakup (Day 14)
3. Reply Tracking — Webhook to mark prospects as replied and notify your team
4. Campaign Reports — Daily metrics: reply rates, bounce rates, step distribution, per-campaign breakdown

Included Workflows

#	File	Purpose
01	01-prospect-import.json	Webhook import with validation, dedup, and Sheets storage
02	02-outreach-sequence.json	Scheduled 4-step email sequence with timing logic
03	03-reply-tracker.json	Webhook to log replies and notify team
04	04-campaign-report.json	Daily campaign analytics email

Architecture

Prospect Import (webhook/CSV)
    |
    v
Workflow 01: Validate & Store
    +-> Deduplicate by email
    +-> Save to Google Sheets (status: new)

Scheduled (every 4 hours):
    |
    v
Workflow 02: Outreach Sequence
    +-> Read prospects with status != replied/bounced
    +-> Check timing (Day 0/3/7/14)
    +-> Send appropriate email template
    +-> Update step + next_send_at in Sheets

Reply received:
    |
    v
Workflow 03: Reply Tracker
    +-> Match email to prospect
    +-> Mark as replied in Sheets
    +-> Notify team via email

Daily Schedule:
    |
    v
Workflow 04: Campaign Report
    +-> Aggregate metrics by campaign
    +-> Reply rate, bounce rate, step distribution
    +-> Email report to admin

Email Sequence

Step	Timing	Template
1 - Initial	Day 0	Introduction + value proposition
2 - Follow-up 1	Day 3	Brief followup + case study mention
3 - Follow-up 2	Day 7	Different angle + call-to-action
4 - Breakup	Day 14	Polite closing, leaves door open

Required n8n Credentials

Credential Type	Used For	Placeholder in JSON
Google Sheets OAuth2	Prospect storage and tracking	YOUR_GOOGLE_SHEETS_CREDENTIAL_ID
SMTP	Sending outreach emails and reports	YOUR_SMTP_CREDENTIAL_ID

Environment Variables

# Required
OUTREACH_SECRET=your-webhook-auth-secret
OUTREACH_ADMIN_EMAIL=[e-mail]

Configuration Placeholders

Placeholder	Description
YOUR_OUTREACH_SHEET_ID	Google Sheet ID for prospect data
YOUR_GOOGLE_SHEETS_CREDENTIAL_ID	n8n Google Sheets credential ID
YOUR_SMTP_CREDENTIAL_ID	n8n SMTP credential ID
YOUR_NOTIFICATION_EMAIL	Fallback admin email (also set via OUTREACH_ADMIN_EMAIL env)

Google Sheets Schema (Prospects)

Column	Type	Description
email	text	Primary key, prospect email
name	text	Prospect name
company	text	Company name
title	text	Job title
campaign	text	Campaign identifier
status	text	new / in_sequence / replied / bounced / completed
step	number	Current sequence step (0-4)
last_sent_at	datetime	When last email was sent
next_send_at	datetime	When next email is due
replied	boolean	Whether prospect replied
replied_at	datetime	Reply timestamp
bounced	boolean	Whether email bounced
imported_at	datetime	Import timestamp

Quick Start

1. Prerequisites

• n8n v2.4+ (self-hosted)
• Google Sheets OAuth2 credentials
• SMTP credentials (dedicated outreach email recommended)

2. Create Prospect Sheet

Create a Google Sheet with the columns above. Name the tab "Prospects".

3. Import & Configure

Import all 4 JSON files into n8n. Replace all YOUR_* placeholders.

4. Import Prospects

curl -X POST https://your-n8n.com/webhook/outreach/import \
  -H "Content-Type: application/json" \
  -d '{
    "_secret": "your-outreach-secret",
    "prospects": [
      {"email": "[e-mail]", "name": "John", "company": "Acme Inc", "campaign": "q1-2026"}
    ]
  }'

5. Track Replies

curl -X POST https://your-n8n.com/webhook/outreach/reply \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "subject": "Re: Quick question", "message": "Sure, let us chat!"}'

Use Cases

1. Freelancers — Automated client prospecting with professional followup
2. Agencies — Multi-campaign outreach with per-campaign analytics
3. SaaS founders — Early-stage customer development outreach
4. Recruiters — Candidate outreach with sequenced followup
5. Sales teams — Supplement CRM with lightweight, self-hosted sequences

Requirements

• n8n v2.4+ (self-hosted recommended)
• Google Sheets OAuth2 credentials
• SMTP email credentials (use dedicated sending domain for deliverability)