lead-generating

Automate lead capture and tracking with Supabase storage and Make.com email workflows, managing conversations from new to qualified status.

Security Scan

The skill implementation matches its stated lead-capture purpose but it explicitly instructs the operator to supply a Supabase Service Role key (full-access credential), which is over‑privileged for an agent integration and undermines RLS protections — this mismatch warrants caution before install.

Purpose & Capability

Name, README, SKILL.md, skill.json and the TypeScript code all implement lead capture, conversation logging, status updates and automation checks against a Supabase backend. The claimed capabilities align with the code and schemas.

Instruction Scope

Runtime instructions ask operators to use the Supabase Service Role Key (SKILL.md / README) which grants full DB privileges and bypasses row-level security — broader scope than a typical per-org agent integration needs. Otherwise instructions stay within lead/automation scope and do not request arbitrary file or system reads.

Install Mechanism

This is an instruction-only skill with a code file and package.json. There is no download-from-arbitrary-URL or installer; standard npm dependency (@supabase/supabase-js) is declared. No extract-from-URL installs or suspicious binaries were found.

Credentials

The skill requires Supabase connection info (supabaseUrl, supabaseKey, orgId) in its config. The SKILL.md and README explicitly instruct using the Service Role Key rather than an anon key — that key is a full-access secret (SECRET-like) and is disproportionate compared to the function (which could be implemented with anon key + RLS or a limited server-side token).

Persistence & Privilege

The skill is not always-enabled, does not request system-wide config changes, and its hooks are simple echo statements. It does not declare elevated platform privileges beyond normal runtime execution.

What to consider before installing

This skill appears to do what it says (lead capture, storing conversations, triggering automations) but it asks you to provide a Supabase Service Role Key — a full-access credential that bypasses Supabase row-level security and can read/write any table. Before installing, consider: - Avoid giving the agent the Service Role Key unless the skill runs in a trusted, server-side environment you control. Prefer using an Anon/public key with properly configured RLS policies, or a narrowly scoped server-side token that only allows the required inserts/queries. - Ask the skill author why the Service Role Key is required and whether the skill can work with RLS or a restricted API key. - Verify where the key will be stored by your platform (is it encrypted/secret-scoped?) and whether the agent runtime could leak it to logs or remote endpoints. - Review and/or run the code in a staging environment to confirm the skill only accesses the declared Supabase tables and does not call unexpected external endpoints. There are references to Make.com/Resend in docs, but no hardcoded webhook URLs in the code — you will need to configure those automations yourself. - Rotate the key after testing and monitor Supabase logs for unexpected queries. If you cannot host the skill in a trusted server-side environment or cannot supply a narrowly scoped credential, treat this skill as unsafe to run with a Service Role Key.

Lead Inbox Automator

Capture leads into a centralized Supabase database with automatic Make.com email automation.

Description

This skill provides a complete lead management system for Clawd agents. It stores leads in Supabase, triggers Make.com webhooks for auto-reply emails, and tracks the full conversation lifecycle from "new" to "qualified".

Configuration

{
  "supabaseUrl": "https://your-project.supabase.co",
  "supabaseKey": "eyJ...your-service-role-key",
  "orgId": "550e8400-e29b-41d4-a716-446655440000",
  "defaultPriority": "medium"
}

Important: Use the Service Role Key, not the Anon Key, for full database access.

Actions

createLead

Create a new lead and automatically trigger the automation workflow.

Parameters:

• email (string, required): Contact email address
• name (string, optional): Contact person name
• phone (string, optional): Phone number
• source (string, optional): Origin channel (default: "clawd_agent")
• priority (string, optional): "low", "medium", "high", "urgent"
• custom_fields (object, optional): Any additional data

Returns:

{
  "success": true,
  "lead_id": "uuid",
  "status": "new",
  "automation_triggered": true,
  "message": "Lead captured. Auto-reply will be sent within 60 seconds."
}

Example:

const result = await skill.createLead({
  email: "[e-mail]",
  name: "Max Mustermann",
  source: "chat_bot",
  custom_fields: { product: "saas_basic" }
});

getLead

Retrieve lead details including full conversation history.

Parameters:

• id (string, required): Lead UUID

Returns: Lead object with conversations array and reply_pending boolean.

listLeads

List leads with filtering options.

Parameters:

• status (string, optional): Filter by status
• priority (string, optional): Filter by priority
• limit (number, optional): Max results (default: 50)
• dateFrom (string, optional): ISO date filter

Returns: Array of leads and total count.

updateStatus

Update lead lifecycle status.

Parameters:

• id (string, required): Lead UUID
• status (string, required): "qualified", "won", "lost", etc.
• notes (string, optional): Qualification notes

addConversation

Add a manual reply or note to the lead thread.

Parameters:

• leadId (string, required): Lead UUID
• content (string, required): Message text
• subject (string, optional): Subject line

getAutomationStatus

Check if the auto-reply email was successfully sent.

Parameters:

• leadId (string, required): Lead UUID

Returns:

{
  "auto_reply_sent": true,
  "minutes_since_creation": 2,
  "automation_ok": true
}

Usage Flow

1. Capture: When a user expresses interest, call createLead()
2. Verify: After 60-120 seconds, call getAutomationStatus() to confirm auto-reply
3. Qualify: During conversation, update status to "qualified" if interested
4. Log: Use addConversation() to store your agent responses

Error Handling

Common errors:

• Invalid email format
• Duplicate lead (within 24h)
• Missing Supabase credentials
• Automation timeout (>5min without reply)

Schema

Leads table:

• id, email, name, phone, source, status, priority
• custom_fields (JSON), metadata (JSON)
• first_reply_sent_at, created_at

Conversations table:

• id, lead_id, direction (inbound/outbound/automated)
• content, subject, channel, sent_at

Tags

lead, crm, sales, automation, email, supabase

Version

1.0.0