Lead Guardian

AI-powered real estate lead response and qualification via SMS, email, or CRM to instantly engage, qualify, and route hot buyer and seller leads for agents.

Security Scan

The skill mostly matches its stated purpose (SMS + AI lead handling) and only asks for the expected Twilio/OpenRouter credentials, but there are several inconsistencies and small-but-important risks in the code and documentation that warrant caution before installing or running it.

Purpose & Capability

Name/description, SKILL.md, and app.py align: the skill implements SMS lead handling, qualification, and routing using Twilio and OpenRouter (Claude model). The requested environment variables (Twilio credentials, OpenRouter API key, optional AGENT_PHONE) are appropriate for the described functionality.

Instruction Scope

SKILL.md and app.py indicate the app will create a local SQLite DB (leads.db) and expose HTTP endpoints (including an admin dashboard). The manifest does not include .env.example or leads.db (they are listed in SKILL.md but not provided), and the shipped app.py is truncated in the provided content (the /sms handler is cut off), so behavior of the remainder of the code (dashboard, auth, /api endpoints, any webhook verification) is unknown. Exposing an unauthenticated admin dashboard or API would be a significant privacy/security risk. Also the system prompt hardcodes an agent identity (Jon Barnato) which leaks/locks the assistant persona and may be undesired.

Install Mechanism

No install spec; this is instruction + Python app. No external downloads or installers are included, so installation risk is limited to installing common Python packages per SKILL.md. That said, the top-of-file comment suggests packages (openai) that are not used; minor inconsistency but not an install-time risk.

Credentials

Declared environment variables (TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, TWILIO_PHONE_NUMBER, OPENROUTER_API_KEY, optional AGENT_PHONE) are proportional to an SMS + AI lead responder. No unrelated credentials or surprising env access are requested.

Persistence & Privilege

The skill does not request always:true and does not declare unusual privileges. It creates a local leads.db file which persists lead data on disk; that's expected for the use case but you should verify file location and retention policy. Ensure the HTTP endpoints (dashboard, APIs) are protected before exposing to the internet.

What to consider before installing

This implementation looks like a straightforward Twilio + OpenRouter lead autoresponder, but exercise caution before using it in production or on real credentials. What to check before installing/running: - Code completeness and authenticity: the provided app.py is truncated in the artifact you gave me. Get the full source from a trusted author or repository and review it before running. - Endpoint authentication: confirm the admin dashboard and /api endpoints require authentication and that Twilio webhook requests are validated (Twilio request signature) to prevent spoofing. Do not expose the app to the public internet without HTTPS and auth. - Credentials: only provide Twilio and OpenRouter API keys if you trust the source. Rotate keys after testing. Use least-privilege Twilio credentials if possible. - Data persistence & privacy: the app writes leads.db in its directory. Verify data retention, backups, and who can access that file on the host. Consider running in an isolated container or VM. - Behavior testing: run locally with dummy credentials first; observe outbound requests (which should be only to Twilio and openrouter.ai). Confirm there are no unexpected external endpoints in the full source. - Hardcoded persona and defaults: the system prompt hardcodes an agent name and comments in the header reference "Jon's phone" — replace with neutral text and configuration variables if you deploy. If you want, I can: (1) attempt to reconstruct the truncated portion if you paste the rest of app.py, (2) list concrete tests to run in a sandbox, or (3) produce a hardened checklist (webhook validation, auth for dashboard, DB encryption) to make this safe to run.

Lead Guardian — Real Estate Lead Response Skill

AI-powered lead response and qualification for real estate agents.

Description

Lead Guardian helps real estate agents respond to leads instantly, qualify them automatically, and route hot leads for immediate follow-up. Works via SMS, email, or CRM webhook integration.

Capabilities

• Instant Response — Reply to new leads within 60 seconds
• AI Qualification — Extract buying/selling intent, timeline, pre-approval status, price range
• Hot Lead Detection — Identify ready-to-buy leads and alert agents immediately
• Conversation Tracking — Full history of lead interactions
• CRM Integration — Connect with Follow Up Boss, KW Command, and others

Use Cases

1. After-Hours Coverage — Respond to leads when you're unavailable
2. Lead Qualification — Filter tire-kickers from serious buyers
3. Speed to Lead — Beat competitors with instant response
4. Consistent Follow-Up — Never miss a lead

Requirements

• Twilio account (for SMS)
• OpenRouter API key (for AI)
• Optional: CRM webhook URL

Quick Start

# Install dependencies
pip install flask twilio requests python-dotenv

# Configure
export TWILIO_ACCOUNT_SID="your_sid"
export TWILIO_AUTH_TOKEN="your_token"
export TWILIO_PHONE_NUMBER="+1xxxxxxxxxx"
export OPENROUTER_API_KEY="your_key"
export AGENT_PHONE="+1xxxxxxxxxx"

# Run
python app.py

Configuration

Environment Variables

Variable	Required	Description
TWILIO_ACCOUNT_SID	Yes	Twilio account SID
TWILIO_AUTH_TOKEN	Yes	Twilio auth token
TWILIO_PHONE_NUMBER	Yes	Your Twilio phone number
OPENROUTER_API_KEY	Yes	For AI responses
AGENT_PHONE	No	Phone to alert for hot leads

Hot Lead Criteria

A lead is flagged as "hot" when:

• Timeline is "immediate" or "1-3 months"
• Pre-approved for mortgage
• Explicitly requests an agent

Qualification Questions

The AI naturally extracts:

1. Direction — Buying, selling, or both
2. Timeline — When they want to move
3. Pre-approval — Mortgage status (if buying)
4. Price Range — Budget (if buying)

API Endpoints

Endpoint	Method	Description
/sms	POST	Twilio webhook for incoming SMS
/api/leads	GET	List all leads
/api/leads/:id/messages	GET	Get conversation history
/api/leads/:id/handoff	POST	Mark lead as handed off
/	GET	Admin dashboard

Cost

~$30/month for 500 leads

• Twilio number: $1/month
• SMS (1,000 messages): $10
• Claude Haiku API: $15-20

Files

lead-guardian/
├── SKILL.md          # This file
├── app.py            # Main Flask application
├── leads.db          # SQLite database (created on run)
└── .env.example      # Environment template

Credits

Built by KW Sacramento Metro AI Team.

License

MIT