Cold Email Outreach

Automate B2B cold email outreach by sourcing leads from Apollo, verifying with Hunter.io, and uploading to Instantly for a 3-email drip campaign in one command.

Security Scan

The skill largely does what it says (parse Apollo CSV → verify via Hunter → upload to Instantly), but there are several inconsistencies and a logic bug that make it worth extra caution before use.

Purpose & Capability

The code and SKILL.md clearly require API keys for Instantly, Hunter, and optionally Apollo; that aligns with the stated purpose. However the registry metadata lists no required credentials or primary credential, which is inconsistent with the included scripts that expect keys in a config.js file. Also SKILL.md references a pipeline.js script (Apollo API scrape) that is not present in the file manifest.

Instruction Scope

Runtime instructions are focused and limited to parsing a user-provided CSV, calling Hunter's verifier, and uploading to Instantly. They correctly instruct adding keys to a local config file and running import-csv.js. The instructions reference pipeline.js (API scrape mode) even though that file is missing; the SKILL.md otherwise does not instruct the agent to read system files or contact endpoints other than Hunter and Instantly.

Install Mechanism

This is an instruction-only skill with included Node.js scripts and no installer or external downloads. No package installs or remote archives are invoked by the skill itself — risk from install mechanism is low. It does require Node.js 18+ to run locally.

Credentials

The script needs service API keys (instantly.apiKey, hunter.apiKey, optional apollo.apiKey) which are proportionate to its function. The manifest failing to declare these required credentials is a metadata problem. Keys are stored in a local config.js file (example provided) rather than environment variables; storing long-lived bearer tokens in a file is a user-side risk to manage.

Persistence & Privilege

The skill does not request persistent platform privileges, does not set always:true, and does not modify other skills or system-wide settings. It runs as a local Node.js script with user-provided inputs.

What to consider before installing

This skill appears to implement the advertised pipeline but has a few issues you should address before using it: - Metadata vs reality: The registry metadata says no credentials are required, but the scripts require API keys (Instanly/Hunter and optionally Apollo) stored in config.js. Don't put keys into a repo; create config.js locally and keep it out of version control. - Missing file: SKILL.md mentions pipeline.js (API scrape mode) but that file isn't included. If you need API scraping you should request or review that missing file before running anything that claims to use it. - Logic bug: verifyEmail treats any non-200 response from Hunter as "valid" (the code returns true when res.status !== 200). That means transient Hunter failures can cause invalid emails to be uploaded — fix the logic to treat non-200 responses as failures or retry. - Data safety: the script reads whatever CSV you pass and will POST those email addresses to Instantly. Ensure you have permission to contact those addresses and comply with anti-spam law and terms of service. - Secrets and storage: storing bearer tokens in plaintext config.js is convenient but risky. Keep the file local, add it to .gitignore, and rotate tokens if they are ever committed accidentally. - Testing and rate limits: test with a small CSV first, confirm Hunter/Instantly quotas and rate limits, and verify campaign configuration in Instantly before launching bulk sends. If you want to proceed, request the missing pipeline.js (if you need Apollo API scraping), patch the verifyEmail logic to handle non-200 responses safely, and ensure API keys are handled securely. If you are unsure, do not run the script on production data until you or a developer have audited these issues.

skill-cold-email-outreach

Apollo → Hunter → Instantly automated cold email pipeline.

Scrape leads, verify emails, upload to campaign — fully automated B2B outreach in one command.

What it does

1. Source leads — Apollo CSV export (free tier) or Apollo API scrape (paid)
2. Verify emails — Hunter.io filters invalid/risky addresses
3. Upload & personalize — pushes verified leads to Instantly v2 with dynamic first lines
4. Sequence — 3-email drip: D0 (ROI pitch) → D3 (pain question) → D8 (soft close)

Requirements

• Node.js 18+
• Apollo.io account (free = CSV export, paid = API)
• Hunter.io API key (free = 25/mo, paid for scale)
• Instantly.ai account + campaign pre-created
• Instantly v2 Bearer token

Setup

# 1. Edit config.js — add your keys
cp scripts/config.example.js scripts/config.js
# Fill in: instantly.apiKey, hunter.apiKey, apollo.apiKey, target ICP

# 2. Run
node scripts/import-csv.js your-apollo-export.csv

Scripts

File	Purpose
import-csv.js	Apollo CSV → Hunter verify → Instantly upload
pipeline.js	Apollo API scrape → Hunter verify → Instantly upload
config.example.js	Config template (copy to config.js)
emails.js	3-email sequence content (customize subject/body)

Target Config

target: {
  industries: ["ecommerce", "retail"],
  countries: ["AE", "SA", "EG"],         // ISO-2 codes
  titles: ["Founder", "CEO", "Owner"],
  perPage: 25,
  maxLeads: 200,
}

Output

📋 Parsed 18 rows from CSV
🔍 Verifying emails with Hunter...
  ✓ [e-mail] — John @ Acme Store
  ✗ [e-mail] — invalid
✅ Verified: 17 / 18 leads
📤 Uploading to Instantly...
╔══════════════════════════════════╗
║  IMPORT COMPLETE ⚡               ║
║  Uploaded: 17                    ║
║  Failed:   0                     ║
╚══════════════════════════════════╝

After running

1. Open app.instantly.ai → your campaign
2. Connect sending inboxes (warm them first)
3. Set daily limit: 40/inbox
4. Hit Launch 🚀

Tips

• Warm inboxes 2–3 weeks before launching cold campaigns
• Apollo free: 50 contacts/month via manual CSV export
• Keep sequences short (3 emails max for cold)
• Personalize first line by industry/location for higher reply rates