Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Pitch Follow-Up Tracker

v1.0.0

Track outreach pitches and draft contextual follow-up emails. Monitors a pitch tracker (Google Sheet or local markdown), checks Gmail for replies, flags stal...

0· 76·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for alexa853/pitch-follow-up-tracker.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Pitch Follow-Up Tracker" (alexa853/pitch-follow-up-tracker) from ClawHub.
Skill page: https://clawhub.ai/alexa853/pitch-follow-up-tracker
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install pitch-follow-up-tracker

ClawHub CLI

Package manager switcher

npx clawhub@latest install pitch-follow-up-tracker
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's actions (checking Gmail, reading a Sheet or local markdown, drafting follow-ups) are coherent with its description. However, the registry metadata lists no required binaries or tools while the SKILL.md explicitly requires the 'gog' CLI for Gmail access and the README mentions a 'web_search' tool — those requirements are not declared in the registry, an inconsistency that should be clarified.
!
Instruction Scope
Runtime instructions tell the agent to run explicit gog gmail and gog sheets commands (expected) and to read local markdown trackers (expected). They also instruct the agent to check 'recent memory/context', 'daily memory files', or any tracker for context — vague directives that could cause the agent to read unspecified local files or personal memory stores. The SKILL.md also truncates the 'add value' flow (likely web lookups) but doesn't declare how those lookups are performed or what external tool is used.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. That reduces supply-chain risk. The real runtime risk comes from the external CLI/tooling it asks to use (gog, possibly a web_search tool).
!
Credentials
The registry declares no environment variables or credentials, yet the SKILL.md requires a configured Google account through the gog CLI (which implies local credentials/access to the user's Gmail). The README also references a web_search tool not declared in registry metadata. The skill's implicit need for Gmail access is proportionate to purpose, but the lack of explicit declaration and the instruction to consult unspecified 'memory' files raises concerns about overbroad local data access.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request persistent or elevated platform privileges. As an instruction-only skill it cannot modify other skills or system-wide settings on its own.
What to consider before installing
Things to check before installing/using this skill: - Confirm the 'gog' CLI it references: where does it come from, is it reputable, and are you comfortable authenticating your Google account through it? Inspect the gog binary/source before installing. - Ask the skill author to update registry metadata to declare required tools (gog, and any web_search tool) so you know exactly what will be invoked. - The skill will run gmail search/get commands that read your inbox and drafts. If you don't want full mailbox access, use a secondary account or limit permissions for the gog credential. - Clarify what 'recent memory/context' and 'daily memory files' refer to; require the skill to ask for explicit permission before reading any non-tracker local files or memory stores. - If using a local markdown tracker, ensure the path is correct and that the file format is acceptable; the skill will parse and extract contact emails and pitch content. - Prefer manual invocation (not autonomous) until you confirm behavior; review generated search queries and draft emails before sending. - If unsure, request the author provide a minimal reproducible runbook or attestations (e.g., exact gog commands used, where web searches occur) or run the skill in an isolated environment/account first.

Like a lobster shell, security has layers — review code before you run it.

latestvk97b7br9z2a7wk7ftm7zzp64nn848p40
76downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Pitch Follow-Up Tracker

Monitor outreach pitches, detect non-replies, and draft contextual, tiered follow-up emails.

Prerequisites

  • gog CLI (required) — for Gmail access
    which gog
    
  • Google account configured with gog (gog gmail --account <email>)
  • Pitch tracker — one of:
    • Google Sheet with outreach data
    • Local markdown file with pitch records

Workflow

1. Collect Configuration

Ask the user (or detect from context):

ParameterRequiredDescription
gmail_accountyesEmail account to check (e.g., you@company.com)
tracker_typeyes"sheet" or "markdown"
tracker_idif sheetGoogle Sheet ID
tracker_pathif markdownPath to local .md file
sender_nameyesName to use in follow-ups
sender_roleoptionalRole/title for email signature context
follow_up_styleoptional"warm" (default), "direct", or "casual"

2. Load Pitch Data

From Google Sheet:

gog sheets get <SHEET_ID> "<TAB_NAME>!A1:Z500" --json --account <gmail_account>

Expected columns (flexible — adapt to whatever columns exist):

  • Contact name / email
  • Brand / company
  • Date sent
  • Subject or pitch summary
  • Status (if tracked)

From Markdown file: Read the file. Expected format (flexible):

## [Brand Name]
- **Contact:** Name <email>
- **Sent:** YYYY-MM-DD
- **Subject:** [pitch subject]
- **Summary:** [what was pitched]
- **Status:** Sent / Replied / Closed

Adapt to whatever format the user actually uses. Extract: contact email, brand, date sent, pitch content/subject, current status.

3. Verify Reply Status (CRITICAL — Do Not Skip Steps)

Before flagging ANY pitch as "needs follow-up," you MUST complete ALL of these checks. Do not skim. Do not skip. A false positive wastes the user's time and erodes trust.

Check 1: Search for direct replies

gog gmail search "from:<contact_email>" --max 10 --account <gmail_account>

Look for any reply from the contact after the pitch send date, even in a different thread.

Check 2: Search by domain (catches new threads)

gog gmail search "from:@<contact_domain>" --max 10 --account <gmail_account>

Brands often respond from a different person at the same company. Check for ANY email from that domain since the pitch date.

Check 3: Search sent folder for user follow-ups

gog gmail search "to:<contact_email> OR to:@<contact_domain>" --max 10 --account <gmail_account>

Check if the user already sent a response, follow-up, or forwarded the thread.

Check 4: Search drafts for unsent responses

gog gmail search "in:drafts <contact_name> OR <brand_name>" --max 5 --account <gmail_account>

A draft response means the user is working on it. Do NOT flag as needing follow-up.

Check 5: Check if forwarded

gog gmail search "subject:Fwd: <original_subject>" --max 5 --account <gmail_account>

If the original email was forwarded to a colleague, talent, or team member, it may be in progress.

Check 6: Read full email threads For any matching threads, read the FULL thread content — not just the latest message. Context changes mid-thread.

gog gmail get <message_id> --account <gmail_account>

Check 7: Check recent memory/context If available, check conversation history, daily memory files, or any tracker for recent context about this deal. The user may have mentioned handling it verbally or via another channel (text, WhatsApp, call).

Classification (only after ALL checks):

  • Replied — contact responded (in same or different thread)
  • Already followed up — user sent a follow-up but no reply yet
  • Draft in progress — user has an unsent draft
  • Forwarded/delegated — user forwarded to someone else
  • Needs follow-up — ALL checks came back empty. No activity since original send.
  • Too fresh — sent less than 3 days ago

4. Calculate Follow-Up Tier

For pitches needing follow-up, determine tier based on days since last outreach:

Days Since Last ContactTierTone
3-6 daysDay 3: Gentle NudgeLight, brief, bumping to top of inbox
7-13 daysDay 7: Add ValueShare something useful — article, idea, new angle
14+ daysDay 14: Final Check-InDirect, low-pressure, leave door open

If user already sent one follow-up, advance to next tier.

5. Draft Follow-Up Emails

Each draft MUST reference the original pitch content. No generic "just checking in" emails.

Day 3 — Gentle Nudge:

Subject: Re: [Original Subject]

Hi [Name],

Wanted to bump this to the top of your inbox — [one sentence referencing the specific pitch content, e.g., "the proposal for a summer campaign series featuring outdoor content"].

Happy to jump on a quick call or send more details if helpful.

[Sender Name]

Day 7 — Add Value:

Subject: Re: [Original Subject]

Hi [Name],

Following up on my note about [specific pitch reference]. Since I sent that over, [add relevant value: a new idea, a relevant trend, a recent success story, a new content example].

Would love to explore how this could work for [Brand]. Open to a quick chat this week?

[Sender Name]

For the "add value" component, search the web for a recent relevant tidbit:

web_search "[brand name] [niche] news 2026"

Incorporate a genuine, relevant insight — not filler.

Day 14 — Final Check-In:

Subject: Re: [Original Subject]

Hi [Name],

Circling back one last time on [specific pitch reference]. Totally understand if the timing isn't right — just wanted to make sure this didn't get buried.

If [Brand] is exploring [relevant type of partnership] down the line, I'd love to be on your radar. Always happy to connect.

[Sender Name]

Adjust tone based on follow_up_style:

  • warm (default): Friendly, relationship-focused
  • direct: Shorter, business-focused, clear ask
  • casual: Conversational, emoji-OK, lighter

6. Output Summary

# Outreach Follow-Up Report

**Date:** [today]
**Account:** [gmail_account]
**Pitches Reviewed:** [total count]

## ✅ Replies Received ([count])
| Brand | Contact | Replied On | Action Needed |
|-------|---------|------------|---------------|
| [Brand] | [Name] | [date] | [Review reply / Schedule call / Send deck] |

## 🔥 Needs Follow-Up ([count])

### Day 3 — Gentle Nudge
**[Brand Name]** → [Contact Name] <[email]>
- Original pitch: [summary]
- Sent: [date] ([X] days ago)
- Draft:
> [Full draft email]

### Day 7 — Add Value
**[Brand Name]** → [Contact Name] <[email]>
- Original pitch: [summary]
- Sent: [date] ([X] days ago)
- Draft:
> [Full draft email]

### Day 14 — Final Check-In
**[Brand Name]** → [Contact Name] <[email]>
- Original pitch: [summary]
- Sent: [date] ([X] days ago)
- Draft:
> [Full draft email]

## ⏳ Too Fresh to Follow Up ([count])
| Brand | Contact | Sent | Follow-Up Date |
|-------|---------|------|----------------|
| [Brand] | [Name] | [date] | [date when Day 3 hits] |

## 📊 Pipeline Summary
- Total active pitches: [X]
- Awaiting reply: [X]
- Replied: [X]
- Follow-ups needed today: [X]

7. Create Gmail Drafts (if requested)

If the user approves the follow-up drafts:

gog gmail draft create --to "<email>" --subject "Re: [subject]" --body "<draft body>" --account <gmail_account>

Always ask before creating drafts. Never send emails without explicit approval.

Error Handling

IssueAction
gog not installedStop and instruct: npm i -g gog or equivalent
Gmail auth expiredPrompt: gog gmail auth --account <email>
Sheet not accessibleVerify Sheet ID and sharing permissions
No pitches found in trackerReport empty tracker, suggest format
Contact email missingFlag the pitch, skip Gmail check for it
Rate limited on GmailSpace queries with 1-2s delays, process in batches
Markdown format unexpectedAdapt parsing to whatever structure exists, ask user if ambiguous

Tips

  • Run this daily or every 2-3 days for best results
  • Keep your pitch tracker updated — the skill is only as good as your data
  • Review and personalize drafts before sending — they're starting points, not final copy
  • The "add value" follow-up works best when you have genuine news or insights to share

Comments

Loading comments...