B2B Lead Generation Scraper

Extracts verified B2B leads (name, email, company, LinkedIn, job title) from target sources and exports them as CRM-ready CSV files.

Security Scan

The skill's instructions plausibly perform LinkedIn scraping, but its metadata omits declared dependencies and it asks for a highly sensitive session cookie (li_at) — an incoherence and privacy/credential risk you should understand before installing.

Purpose & Capability

The SKILL.md declares it needs python3, selenium, webdriver-manager, pandas, requests, and Chromium and explicitly requires a LinkedIn session cookie (li_at). The registry metadata, however, lists no required binaries or environment variables — this mismatch is an incoherence. Requesting a LinkedIn session cookie is functionally consistent with the stated purpose (authenticated scraping), but the omission from the declared requirements is suspicious and reduces transparency.

Instruction Scope

The runtime instructions explicitly tell the user to extract their LinkedIn 'li_at' cookie and place it into OpenClaw Secrets, to run headless Chromium via Selenium, and to save raw scraped data to data/raw/. The instructions do not ask for other unrelated files or secrets, nor do they declare uploading to external endpoints, but asking for a session cookie enables full account impersonation if misused. The SKILL.md enforces scraping rate limits and deduplication (good hygiene) but does not describe safeguards around use of the session cookie or legal/ToS constraints.

Install Mechanism

This is an instruction-only skill (no install spec and no code files), which reduces direct install risk. However, the SKILL.md lists several runtime dependencies (Python packages and Chromium) without providing an install mechanism — this is an informational omission that could lead users to install arbitrary packages themselves. No download URLs or installers are present.

Credentials

The only sensitive credential the skill asks for is the LinkedIn session cookie (li_at). That is proportional to the stated task (authenticated scraping), but the registry metadata did not declare this required environment variable, creating an inconsistency. li_at is a high-privilege secret: anyone with it can act as your account, so requiring it is a significant risk and deserves clear justification and alternatives (e.g., OAuth, official API).

Persistence & Privilege

The skill is not marked 'always:true' and is user-invocable only; it does not request system-wide persistence in the provided materials. It does direct writing of files under data/raw/ and CSV outputs, which is normal for this purpose but means scraped data will be stored in the agent's workspace.

Scan Findings in Context

[no_code_files_to_scan] expected: The regex-based scanner had no code files to analyze; the skill is instruction-only (SKILL.md) so static findings are absent by design.

What to consider before installing

Before installing: (1) Verify the skill source and trustworthiness — the registry metadata omits the LI_SESSION requirement that appears in SKILL.md. (2) Treat your LinkedIn 'li_at' cookie as a full-account secret: prefer not to share it. Consider using a throwaway/test account if you must. (3) Confirm legal and Terms-of-Service implications of scraping LinkedIn and your organization's policy. (4) Because there's no install script, be prepared to install Python, Selenium, Chromium, and dependencies yourself in an isolated environment. (5) Ask the publisher why the required env var and runtime dependencies are missing from the registry metadata and whether there is a safer auth option (OAuth or API token) before proceeding.

Overview

Automated lead extraction tool that collects verified B2B contact data from target sources and delivers clean, CRM-ready CSV files. Delivers 500-2,000+ leads per run depending on target criteria.

What It Does

• Extracts: Full name, job title, company name, LinkedIn URL, email (when available)
• Filters by: industry, job title keywords, company size, location
• Deduplicates records automatically
• Outputs clean CSV ready for HubSpot, Salesforce, Pipedrive import
• Validates and removes junk/incomplete rows before delivery

Required Environment Variables

Set these in OpenClaw's Secrets manager before running:

Variable	Description
LI_SESSION	LinkedIn session cookie (li_at value from your browser)

Setup

1. Log into LinkedIn in your browser, copy the li_at cookie value
2. Set LI_SESSION in OpenClaw Secrets
3. Define target criteria in OpenClaw chat (industry, job title, location, company size)
4. Chromium must be available on the host for Selenium headless mode

Usage

"Find 500 B2B leads: SaaS CEOs in the United States" "Scrape marketing directors at companies with 50-200 employees in London" "Generate a lead list of HR managers in healthcare companies" "Export leads to CSV formatted for HubSpot import"

Output

• leads_YYYY-MM-DD_[criteria].csv with columns:
  • first_name, last_name, full_name, job_title, company, linkedin_url, email, location
• Summary: total found, duplicates removed, validation pass rate

Rules

• Never scrape more than 200 profiles per hour to avoid detection
• Always deduplicate by LinkedIn URL before saving
• Mark rows with missing email as email_status: not_found — do not fabricate
• Save raw data before cleaning in data/raw/
• Output CSV must be UTF-8 encoded for CRM compatibility