Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Seo Prospector

Automated SEO prospect research and outreach for web designers, agencies, and freelancers. Use when researching local business prospects, running scheduled p...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 357 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description claim automated prospect research and outreach; the repository contains matching Python scripts, templates, and tracking logic — so purpose and capabilities line up. However, the skill claims integrations (Perplexity web research, Discord summaries, outreach over email/DM/LinkedIn/SMS) but declares no required environment variables, API keys, or service credentials in the registry metadata or SKILL.md. That mismatch (no declared credentials while code likely calls external services) is an incoherence worth flagging.
Instruction Scope
SKILL.md is fairly scoped to prospect discovery → research → audit → outreach → tracking. It instructs writing config and outputs into ~/.openclaw/workspace/leads/... which is appropriate for a lead pipeline. It also includes ready-to-send outreach templates (email/DM/LinkedIn/SMS) and scheduling guidance; that is expected but raises operational/ethical considerations (automated cold outreach/spam). The instructions do not explicitly tell the agent to read unrelated system files or harvest unrelated secrets.
Install Mechanism
This is an instruction-plus-code skill with no install spec. That lowers automatic install risk, but is a usability/consistency gap: Python scripts exist but SKILL.md and clawhub.json do not list required Python packages, virtualenv instructions, or dependency pins. The PUBLISH-INSTRUCTIONS mention using clawhub CLI but not runtime Python deps. Lack of declared install steps is a maintenance/security concern (unknown runtime environment).
!
Credentials
The skill requests no environment variables or primary credential, but its functionality (Perplexity search, Discord-formatted daily summaries, generating outreach and potentially sending messages) typically requires API keys/webhooks/SMTP or third-party credentials. The absence of declared credentials is disproportionate and leaves unclear whether scripts will prompt for, hardcode, or exfiltrate secrets at runtime.
Persistence & Privilege
always:false and default autonomous invocation are appropriate. The skill writes config and prospect reports under ~/.openclaw/workspace/leads/, which is consistent with its function and not an unusual privilege request. Nothing in the manifest asks to modify other skills or system-wide configuration.
What to consider before installing
What to check before installing or running: - Read the Python scripts (especially seo_quick_audit.py, perplexity_search.py, create_outreach.py, daily_summary.py, prospect_tracker.py, verify_prospect.py) for any network calls and where they send data. Grep for strings like requests.post, requests.get, smtplib, smtp, discord, webhook, twilio, linkedin, perplexity, api_key, TOKEN, PASSWORD, os.environ, subprocess, socket, or hardcoded URLs/IPs. - Identify required credentials: the code likely needs API keys/webhooks (Perplexity, Discord), SMTP credentials or an outbound mail service, and any SMS/LinkedIn automation tokens. The skill does not declare these — confirm how credentials are provided and where they are stored (avoid plaintext in repo). If credentials are required, prefer storing them in well-scoped environment variables or a secrets manager rather than plaintext config files. - Confirm whether the scripts actually send messages or only generate drafts: inspect create_outreach.py and generate_outreach_batch.py to see if they attempt to deliver emails/DMs or only write files for manual review. If they send messages, verify rate limits, sending channels, and opt-in/opt-out handling to reduce legal/spam risk. - Run the code in an isolated environment (container or VM) first. Perform static checks (python -m py_compile, linting) and run with network access blocked to see what files are written locally. Then selectively enable network to test individual integrations. - Check for hardcoded personal info or third-party endpoints (clawhub.json references a louisvillewebguy homepage/support). If you plan to publish or use the skill commercially, replace sample agency PII in examples and config-template.json. - Consider privacy and legal concerns: automated cold outreach can violate platform terms (LinkedIn, Instagram, Twilio) and anti-spam laws (CAN-SPAM, TCPA). Ensure you have lawful basis and consent for messaging targets. If you want, paste the contents of the key Python scripts here (or allow me to scan them) and I can point to exact lines that require credentials or communicate externally — that would raise confidence and allow a more specific recommendation.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97bd0kgbk0ah2cbcb7p6p5m1d81pzng

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

SEO Prospector

Automated local business lead generation for web designers and agencies.

Pipeline: discover → research → audit → report → outreach → track.

How It Works

This skill turns you into a prospecting machine. Point it at a city or industry, and it:

  1. Finds businesses with weak websites (via SEO audit + web research)
  2. Generates detailed prospect reports with specific issues found
  3. Creates personalized outreach (HTML emails, LinkedIn messages, DMs)
  4. Tracks everything in a database with dedup + cluster rotation
  5. Delivers daily summaries of your pipeline health

Setup (First Run)

Before using, configure your agency details:

# Copy and edit the config file
cp references/config-template.json ~/.openclaw/workspace/leads/data/seo-prospector-config.json

Edit the config with your info:

{
  "agency": {
    "name": "Your Agency Name",
    "owner": "Your Name",
    "phone": "(555) 123-4567",
    "email": "you@agency.com",
    "website": "youragency.com",
    "city": "Your City",
    "tagline": "Your one-liner value prop"
  },
  "outreach": {
    "default_tone": "casual",
    "signature_style": "friendly"
  }
}

Quick Reference

Research One Prospect

python3 scripts/research_prospect.py \
  --business "Business Name" --domain "example.com" --industry "Restaurant" \
  --priority HIGH --cluster "Restaurants"

Batch Research (Today's Rotation)

python3 scripts/batch_research.py --run morning    # Today's run_1 cluster
python3 scripts/batch_research.py --run afternoon   # Today's run_2 cluster
python3 scripts/batch_research.py --cluster "Restaurants" --limit 5

Generate Outreach

python3 scripts/create_outreach.py --report path/to/report.md --template casual
python3 scripts/create_outreach.py --business "Name" --template professional --format html

Daily Summary

python3 scripts/daily_summary.py                     # Today, Discord format
python3 scripts/daily_summary.py --date 2026-02-09 --format markdown

Pipeline Management

python3 scripts/prospect_tracker.py today-clusters
python3 scripts/prospect_tracker.py check --business "Name"
python3 scripts/prospect_tracker.py stats
python3 scripts/prospect_tracker.py outreach-ready

Workflow

1. Check Schedule & Dedup

  • Run prospect_tracker.py today-clusters to see scheduled clusters
  • Run prospect_tracker.py check --business "Name" before researching (14-day dedup window)

2. Research Phase

Data sources in priority order:

  1. SEO Quick Audit (seo_quick_audit.py) — on-page technical analysis
  2. Perplexity Search (perplexity_search.py) — business intel, reviews, reputation
  3. Browser verification (optional) — visual check for high-priority prospects

3. Report Generation

Reports follow references/research-template.md. Key sections:

  • Executive Summary (specific findings, not generic)
  • Business Overview (what they do, how long, reviews)
  • Online Presence Analysis (SEO audit results with pass/fail)
  • Why [Your Agency] (pitch angle customized to their gaps)
  • Contact & Next Steps (confidence level + recommended action)

Output: ~/.openclaw/workspace/leads/prospects/YYYY-MM-DD-{cluster}/{business}.md

4. Outreach Generation

scripts/create_outreach.py supports:

  • HTML emails (professional, mobile-responsive, branded)
  • Plain text emails (casual, no-frills)
  • LinkedIn messages (see references/outreach-templates.md)
  • DMs (Instagram, Facebook, SMS — see assets/templates/dm-outreach.md)

Each outreach package includes:

  • Email draft (HTML or plain text)
  • Review checklist for manual QA
  • Tracking JSON for pipeline status

5. Pipeline Tracking

Every prospect gets tracked via prospect_tracker.py add. The database enables dedup, coverage stats, cluster tracking, and outreach status.

Status pipeline: draft_ready → pending_review → approved → sent → followed_up → responded → closed

Priority Scoring (Strict)

Aim for ~30% HIGH, ~50% MEDIUM, ~20% LOW:

  • HIGH: No website OR completely broken site, AND business confirmed active
  • MEDIUM: Has website but major SEO gaps (no H1, no meta, no schema, bad mobile), AND confirmed active
  • LOW: Decent website with minor issues, OR business activity unconfirmed

If unsure, default to MEDIUM.

Verification (Mandatory)

Before recording any prospect, verify:

python3 scripts/verify_prospect.py <report_path>

Skip prospects with: dead URLs, parked domains, suspended hosting, permanently closed businesses.

Scripts

ScriptPurpose
scripts/research_prospect.pyFull pipeline for single prospect
scripts/batch_research.pyResearch multiple prospects from cluster or input
scripts/create_outreach.pyGenerate personalized outreach (HTML + plain text)
scripts/generate_outreach_batch.pyBatch outreach for all prospects from a date
scripts/daily_summary.pyPipeline summary (Discord or markdown)
scripts/prospect_tracker.pyDatabase, dedup, cluster rotation, stats
scripts/verify_prospect.pyURL/domain/phone verification
scripts/seo_quick_audit.pyOn-page SEO technical audit

References

FileUse When
references/research-template.mdWriting or reviewing prospect reports
references/outreach-templates.mdDrafting email/LinkedIn/DM outreach
references/industry-insights.mdIndustry-specific talking points
references/objection-handling.mdHandling "we already have a site" etc.
references/config-template.jsonFirst-time setup of agency details
references/cluster-template.jsonSetting up industry cluster rotation

Assets

  • assets/templates/email-html.html — Professional HTML email template with merge fields
  • assets/templates/email-plain.txt — Plain text email template
  • assets/templates/linkedin-message.md — LinkedIn outreach templates
  • assets/templates/dm-outreach.md — DM templates (SMS, IG, FB)
  • assets/examples/example-report.md — Completed prospect report
  • assets/examples/example-outreach.md — Completed outreach package

Cron Integration

Designed for automated daily prospecting:

8:30 AM  — SERP Gap Scanner (identify opportunities for 5 industries)
10:00 AM — batch_research.py --run morning (Tier A/B cluster)
11:30 AM — batch_research.py --run afternoon (Tier B/C cluster)
5:00 PM  — daily_summary.py (pipeline summary)

Quality Rules

  1. Always check for duplicates first (14-day window)
  2. Minimum 2 data sources per prospect (SEO audit + web research)
  3. Specific findings only — "missing H1 tag" not "SEO issues"
  4. Authentic compliments — if their site is good, say so honestly
  5. 5 prospects per cluster max — depth over breadth
  6. Match outreach tone to industry — casual for restaurants, professional for law firms
  7. Verify every prospect before recording — no dead URLs, no parked domains
  8. Never exaggerate issues — stick to what the audit actually found

Error Handling

  • Site unreachable: Research via web search only, note limitation
  • Duplicate detected: Skip with message, don't waste API calls
  • Search timeout: Continue without, flag as lower confidence
  • Empty cluster: Log and move on (cluster may be exhausted)
  • Minimum data: Business name + (domain OR industry) required

Files

24 total
Select a file
Select a file to preview.

Comments

Loading comments…