Lead Outreach CRM

Track leads locally, manage outreach campaigns, and export as CSV for download.

Security Scan

The skill is internally coherent: it implements a local, file-based CRM (save/list/log/export/clear) and does not request credentials, external installs, or network access in the files reviewed.

Purpose & Capability

The name/description (local lead tracking, outreach sequences, CSV export) match the code and SKILL.md. The code implements lead scoring, outreach template generation, saving/loading leads to a local JSON file, and CSV export — all expected for a local CRM skill.

Instruction Scope

Runtime instructions are limited to running the provided Node CLI and working with files in the agent workspace (/root/.openclaw/workspace by default). The SKILL.md does not instruct reading unrelated system files or sending data to external endpoints. Note: the skill writes lead data to the agent workspace, so exported/stored leads (which may include PII) reside in container storage until removed.

Install Mechanism

No install spec — instruction-only with a single JS file and package.json. Nothing is downloaded or written during install from external URLs.

Credentials

The skill declares no required credentials or env vars, which matches its local-only behavior. The code reads OPENCLAW_WORKSPACE (process.env.OPENCLAW_WORKSPACE) as an override for workspace location; this env var is not listed in SKILL.md's 'requires' but its use is low-risk and limited to where data is stored.

Persistence & Privilege

The skill does not request always: true and does not modify other skills. It persists data only to its workspace files (leads.json, leads.csv), which is expected for a local CRM.

Assessment

This skill appears to do exactly what it says: store leads locally and export CSVs. Before installing, consider: (1) Stored leads live in the agent workspace (/root/.openclaw/workspace by default) — don't store sensitive PII there unless you're comfortable with that storage. (2) You can change the workspace path with OPENCLAW_WORKSPACE if needed (the code reads that env var). (3) There is no external sync in the code you reviewed (CRM sync is noted as a paid-plan placeholder), but if you rely on off-box sync, verify any additional paid-plan code. (4) Use the 'clear' command carefully — it deletes local leads. If you need higher assurance, review the full JS file (CLI handlers) before use or run in an isolated environment.

Outreach CRM Skill

Manage lead generation outreach. Leads are stored in a local JSON file inside the agent workspace — no external database required. Users can view leads in chat or export them as a CSV file.

Available Tools

Run with Node.js: node {baseDir}/outreach-crm.js <command> [args]

• add-lead - Add a new lead to the local leads file
• list - List all tracked leads (displays in chat)
• log - Log an interaction with a lead
• export-csv - Export all leads to a CSV file and print the file path
• clear - Remove all leads (use with caution)

Usage

node {baseDir}/outreach-crm.js add-lead --name "John" --source "twitter" --handle "@john" --score 75 --tier hot
node {baseDir}/outreach-crm.js list
node {baseDir}/outreach-crm.js log <lead_id> "Sent intro DM"
node {baseDir}/outreach-crm.js export-csv

Storage

Leads are saved to /root/.openclaw/workspace/leads.json inside the container. CSV exports are written to /root/.openclaw/workspace/leads.csv. Always show the user the export path so they can download it.