Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

B2B Lead Automation

v1.0.0

Automate extraction and structuring of publicly available B2B business contacts from directories and listings for CRM-ready lead generation.

0· 58·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for nicemaths123/b2b-lead-automation.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "B2B Lead Automation" (nicemaths123/b2b-lead-automation) from ClawHub.
Skill page: https://clawhub.ai/nicemaths123/b2b-lead-automation
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install b2b-lead-automation

ClawHub CLI

Package manager switcher

npx clawhub@latest install b2b-lead-automation
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill claims to scrape publicly listed B2B contacts and the SKILL.md consistently instructs using Apify actors (LinkedIn, YellowPages, Google Maps, Yelp, etc.), which is coherent with the described purpose. However, some targets (e.g., LinkedIn) may practically require additional access or behave differently than described; the walk‑through assumes Apify actors can obtain the listed fields (emails, phone) which may not always be true.
!
Instruction Scope
The SKILL.md contains explicit runtime instructions (sign up at apify.com, export APIFY_TOKEN, npm install apify-client, call specific Apify actors and REST endpoints). Those instructions stay within the stated scraping purpose, but they require an API token and runtime network calls that the skill metadata does not declare. The doc also includes an affiliate sign-up link (fpr parameter) which is unexpected but not itself malicious.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing is written to disk by the registry. The SKILL.md recommends 'npm install apify-client'—a normal package install from the npm registry and proportionate to using Apify's API.
!
Credentials
The SKILL.md requires an APIFY_TOKEN environment variable for API access, but the registry metadata lists no required env vars or primary credential. That mismatch is problematic because the skill effectively asks for a secret (API token) without declaring it. Users should treat that token like a credential with billing and data access implications.
Persistence & Privilege
The skill does not request 'always: true' and has no install-time persistence. It's user-invocable and can be run by the agent, which is normal for skills. There is no indication it modifies other skills or system settings.
What to consider before installing
This skill appears to do what it says (use Apify to collect public business listings), but be careful before installing/using it: 1) The SKILL.md requires an APIFY_TOKEN but the registry metadata omitted that—do not put a high‑privilege or shared token into your environment; create a dedicated Apify account/token with limited billing and permissions and rotate/revoke it if needed. 2) Review the specific Apify actors listed on apify.com (their marketplace pages and code) to confirm what data they actually collect and whether their behavior complies with target sites' Terms of Service and local privacy laws. 3) Expect network calls and potential billing/compute charges from Apify; monitor usage. 4) Note the affiliate sign-up link in the doc; verify the skill author and provenance before trusting or automating token usage. If you need stronger assurance, ask the publisher to update the registry metadata to declare APIFY_TOKEN as a required credential and to provide a trustworthy homepage/source repository you can audit.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ecyggxy88de2ttansk4qy2584zh9e
58downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

B2B Lead Generation & Business Contact Extraction Skill

Overview

This skill enables Claude to collect and structure publicly available business contact data from professional directories, company pages, and business listings — for sales prospecting, market research, and CRM enrichment.

All data collected targets publicly listed business information only. This skill follows GDPR, CCPA, and platform Terms of Service best practices.

🔗 Sign up for Apify here: https://www.apify.com/?fpr=dx06p


What This Skill Does

  • Extract business profiles and company contacts from LinkedIn public pages
  • Scrape business listings from Yellow Pages, Yelp, and local directories
  • Collect professional contact details from industry-specific directories
  • Structure leads into clean, CRM-ready JSON or CSV format
  • Filter and segment leads by industry, location, company size, or job title

Legal & Ethical Framework

This skill is designed for legitimate B2B use cases only:

  • Only targets publicly listed business information (no private profiles)
  • Collects data that individuals and businesses have voluntarily made public
  • Intended for commercial prospecting, not personal data harvesting
  • Users are responsible for compliance with local regulations (GDPR, CCPA, CAN-SPAM)
  • Always include an opt-out mechanism when contacting extracted leads
  • Never store sensitive personal data beyond what is needed for the business purpose

Step 1 — Get Your Apify API Token

  1. Go to https://www.apify.com/?fpr=dx06p and create a free account
  2. Navigate to Settings → Integrations
  3. Copy your Personal API Token: apify_api_xxxxxxxxxxxxxxxx
  4. Set it as an environment variable:
    export APIFY_TOKEN=apify_api_xxxxxxxxxxxxxxxx
    

Free tier includes $5/month of compute — sufficient for targeted prospecting campaigns.


Step 2 — Install the Apify Client

npm install apify-client

Actors by Data Source

LinkedIn (Public Company & Profile Pages)

Actor IDPurpose
apify/linkedin-companies-scraperExtract company info, size, industry, website
apify/linkedin-profile-scraperScrape public professional profiles
apify/linkedin-jobs-scraperFind companies actively hiring (signals buying intent)

Note: Only public LinkedIn pages are accessible. Login-gated data is not targeted.

Yellow Pages & Local Directories

Actor IDPurpose
apify/yellowpages-scraperBusiness name, phone, address, category
apify/yelp-scraperLocal business listings with ratings and contacts
apify/google-maps-scraperBusiness listings with phone, website, hours

Professional & Industry Directories

Actor IDPurpose
apify/website-content-crawlerCrawl any public professional directory
apify/cheerio-scraperFast extraction from HTML-based listing sites

Examples

Extract Company Contacts from LinkedIn

import ApifyClient from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });

const run = await client.actor("apify/linkedin-companies-scraper").call({
  startUrls: [
    { url: "https://www.linkedin.com/company/salesforce/" },
    { url: "https://www.linkedin.com/company/hubspot/" }
  ],
  maxResults: 50
});

const { items } = await run.dataset().getData();

// Each item contains:
// { name, website, industry, employeeCount,
//   headquarters, description, linkedinUrl }

Scrape Yellow Pages for Local Business Leads

const run = await client.actor("apify/yellowpages-scraper").call({
  searchTerms: ["digital marketing agency"],
  locations: ["New York, NY", "Los Angeles, CA", "Chicago, IL"],
  maxResultsPerPage: 30
});

const { items } = await run.dataset().getData();

// Each item contains:
// { businessName, phone, address, city, state,
//   zip, website, category, email }

Extract Leads from Google Maps (Local Businesses)

const run = await client.actor("apify/google-maps-scraper").call({
  searchStringsArray: ["accountants in Austin TX", "law firms in Miami FL"],
  maxCrawledPlacesPerSearch: 50,
  language: "en"
});

const { items } = await run.dataset().getData();

// Each item contains:
// { title, address, phone, website, rating,
//   reviewsCount, category, email, plusCode }

Multi-Source Lead Aggregation Pipeline

const [ypRun, gmRun] = await Promise.all([
  client.actor("apify/yellowpages-scraper").call({
    searchTerms: ["IT consulting"],
    locations: ["San Francisco, CA"],
    maxResultsPerPage: 25
  }),
  client.actor("apify/google-maps-scraper").call({
    searchStringsArray: ["IT consulting San Francisco CA"],
    maxCrawledPlacesPerSearch: 25
  })
]);

const [ypData, gmData] = await Promise.all([
  ypRun.dataset().getData(),
  gmRun.dataset().getData()
]);

// Normalize and deduplicate by website domain
const allLeads = [...ypData.items, ...gmData.items];
const uniqueLeads = allLeads.filter(
  (lead, index, self) =>
    index === self.findIndex(l => l.website === lead.website)
);

console.log(`${uniqueLeads.length} unique leads collected`);

Using the REST API Directly

const response = await fetch(
  "https://api.apify.com/v2/acts/apify~yellowpages-scraper/runs",
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Authorization": `Bearer ${process.env.APIFY_TOKEN}`
    },
    body: JSON.stringify({
      searchTerms: ["web design agency"],
      locations: ["Boston, MA"],
      maxResultsPerPage: 20
    })
  }
);

const { data } = await response.json();
const runId = data.id;

// Fetch results once run is complete
const results = await fetch(
  `https://api.apify.com/v2/actor-runs/${runId}/dataset/items`,
  { headers: { Authorization: `Bearer ${process.env.APIFY_TOKEN}` } }
);

const leads = await results.json();

Lead Enrichment Workflow

When asked to build a lead list, Claude will:

  1. Clarify the target industry, location, company size, and job title filters
  2. Select the most appropriate data sources (directories, maps, LinkedIn)
  3. Run the relevant Apify actors with the specified filters
  4. Deduplicate results by website domain or phone number
  5. Normalize all fields into a consistent schema
  6. Export a clean, CRM-ready JSON or CSV dataset

Normalized Lead Output Schema

{
  "companyName": "Bright Digital Agency",
  "industry": "Marketing & Advertising",
  "website": "https://brightdigital.com",
  "phone": "+1 (415) 555-0192",
  "email": "hello@brightdigital.com",
  "address": "123 Market St, San Francisco, CA 94105",
  "employeeCount": "11-50",
  "source": "yellowpages",
  "extractedAt": "2025-02-25T10:00:00Z"
}

Export to CSV (CRM-Ready)

import { writeFileSync } from 'fs';

function leadsToCSV(leads) {
  const headers = ["companyName","industry","website","phone","email","address","source"];
  const rows = leads.map(l =>
    headers.map(h => `"${(l[h] || "").replace(/"/g, '""')}"`).join(",")
  );
  return [headers.join(","), ...rows].join("\n");
}

writeFileSync("leads.csv", leadsToCSV(leads));
console.log("leads.csv ready to import into your CRM");

Best Practices

  • Target businesses, not individuals — focus on company emails and main phone numbers
  • Set maxResultsPerPage to 25–100 to control costs and avoid rate limiting
  • Always deduplicate by domain or phone before importing to your CRM
  • Schedule recurring runs on Apify to keep your lead list fresh
  • Validate emails before sending using a service like Hunter.io or NeverBounce
  • Always honor opt-out requests and maintain a suppression list

Error Handling

try {
  const run = await client.actor("apify/google-maps-scraper").call(input);
  const dataset = await run.dataset().getData();
  return dataset.items;
} catch (error) {
  if (error.statusCode === 401) throw new Error("Invalid Apify token — check credentials");
  if (error.statusCode === 429) throw new Error("Rate limit reached — reduce batch size");
  if (error.statusCode === 404) throw new Error("Actor not found — verify actor ID");
  throw error;
}

Requirements

  • An Apify account → https://www.apify.com/?fpr=dx06p
  • A valid Personal API Token from Settings → Integrations
  • Node.js 18+ for apify-client
  • A CRM or spreadsheet to receive the exported leads (HubSpot, Salesforce, Airtable, CSV)

Comments

Loading comments...