Real Estate Leads

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is upfront about scraping real-estate listings and generating outreach, but users should be careful with the Apify token, third-party scrapers, and collected contact information.

Install only if you are comfortable using Apify and third-party scrapers for real-estate lead generation. Keep the Apify token scoped and protected, set clear search limits, verify that scraping and outreach comply with applicable laws and site terms, and review any generated email or SMS before sending.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may gather phone numbers or emails and draft messages for sellers or agents, which could create privacy, compliance, or spam concerns if used carelessly.

Why it was flagged

The skill clearly intends to collect contact details and prepare outreach. That is central to the lead-generation purpose, but it can affect real people and should remain user-controlled.

Skill content
Find owner & agent contact details — name, email, phone ... Cross-reference Google for additional contact details ... Generate personalized outreach — email + SMS + follow-up sequence
Recommendation

Use explicit target areas and lead limits, collect only appropriate public or authorized contact information, and manually review outreach before sending anything.

What this means

An Apify token could allow usage billed to the user's account or access to the user's Apify resources if mishandled.

Why it was flagged

The workflow expects a user-supplied Apify token. This is purpose-aligned for running Apify actors, but it is credential handling and the registry metadata does not declare a primary credential.

Skill content
"apify_token": "YOUR_APIFY_TOKEN"
Recommendation

Use a scoped or dedicated Apify token where possible, avoid pasting long-lived secrets into shared contexts, and rotate the token if exposure is suspected.

What this means

External actors may change behavior, have their own permissions, process inputs, or produce untrusted outputs that the agent relies on.

Why it was flagged

The skill depends on multiple third-party Apify actors that are not included in the artifact set reviewed here.

Skill content
Zillow Scraper | maxcopell/zillow-scraper ... Rightmove Scraper | dhrumil/rightmove-scraper ... Google Search Scraper | apify/google-search-scraper
Recommendation

Review the Apify actor pages, permissions, pricing, and trustworthiness before use, and treat scraped output as untrusted data to verify.

What this means

Target locations, buyer profile details, scraped leads, and contact information may be processed outside the local agent environment.

Why it was flagged

The documented workflow uses external provider services; the visible artifact does not specify retention, sharing, or data-boundary details for the information sent to those services.

Skill content
**Powered by:** [Apify](https://www.apify.com?fpr=dx06p) + Claude AI
Recommendation

Avoid including unnecessary sensitive buyer information, review provider privacy terms, and limit outputs to what is needed for the specific lead search.