WhatsApp Lead Hunter

Automated lead generation and WhatsApp outreach system. Scrape business leads from Google Maps by sector and location, generate personalized pitch messages,...

Security Scan

The skill's files and runtime instructions are internally consistent with its stated purpose (scraping Google Maps leads and sending WhatsApp messages via a local WAHA API); there are no unexpected credentials, installs, or hidden endpoints, but there are operational and privacy/abuse risks you should be aware of.

Purpose & Capability

The name/description (lead scraping + WhatsApp outreach) matches the included SKILL.md, pitch templates, and the batch_send.sh script. The script implements the advertised send flow (reads leads JSON, personalizes messages, posts to WAHA API, appends ignore list). No extraneous credentials, packages, or unrelated binaries are requested.

Instruction Scope

Instructions explicitly instruct the agent to use a browser tool to scrape Google Maps and extract phone numbers, websites, reviews, etc. That is within the claimed purpose but expands the agent's scope to interacting with third-party web pages (and potentially harvesting contact data). The SKILL.md also suggests forwarding inbound outreach replies to an admin (notify_admin), but does not define how that notification is implemented or secured — this could result in routing message content to external channels if configured. The instructions do not ask the agent to read unrelated local config or secret env vars.

Install Mechanism

No install spec (instruction-only) and the only code is a small bash script. Nothing is downloaded or extracted from external URLs. Risk from installation is low.

Credentials

The skill requests no declared environment variables and expects the WAHA API key to be supplied at runtime (script argument or environment) — that is proportionate to its function. Small inconsistency: SKILL.md mentions using 'OpenClaw CLI for any gateway operations' but provides no OpenClaw commands or required credentials; this is a minor documentation mismatch, not a hidden requirement. No other credentials or system-wide config paths are requested.

Persistence & Privilege

The skill is not marked always:true and does not request persistent or elevated platform privileges. Its behavior is confined to creating/using local files (leads JSON, ignore list) and POSTing to a WAHA API endpoint that the user must run/configure.

Assessment

This skill appears to do what it claims, but consider the following before installing or running it: - Legal/ethical risk: scraping Google Maps and sending cold WhatsApp messages can violate Google’s terms of service and local spam/privacy laws. Confirm you have the right to collect and message these contacts. - Data exfiltration/notification endpoints: the webhook snippet references notify_admin (Telegram/SMS/etc.) but doesn't specify where notifications go — review any admin notification configuration to ensure message content/phone numbers are not sent to untrusted external endpoints. - WAHA API key security: the WAHA key is required at runtime; treat it as a secret and only point the script to a WAHA instance you control (localhost or a secured host). - Test in dry-run mode first: the script supports --dry-run; use it and small batches (10–15 leads) as suggested before scaling. - Respect rate limits and recipients: keep delays and batch sizes conservative and maintain an ignore list as recommended to avoid bot conflicts and account suspension. - Documentation mismatch: the SKILL.md mentions OpenClaw CLI for gateway operations but provides no examples — clarify this before relying on any automated gateway actions. If you are comfortable with these operational and compliance concerns and you control the WAHA instance and notification endpoints, the skill is internally coherent. If any of these points are unclear or unacceptable, do not enable the skill until they are resolved.

Automated lead generation pipeline: Google Maps → Lead Database → Personalized Pitch → WAHA WhatsApp Delivery.

How It Works

1. Scrape — Use browser tool to search Google Maps for businesses by sector + location
2. Extract — Pull name, phone, rating, reviews, website, Instagram from each listing
3. Store — Save leads as JSON in organized directory structure
4. Pitch — Generate personalized messages based on business profile (rating, website presence, pain points)
5. Send — Deliver via WAHA WhatsApp API with configurable delays between messages
6. Protect — Add all outreach numbers to bot ignore list (prevents auto-reply conflicts)

Prerequisites

• WAHA running (WhatsApp HTTP API) — Docker container with active WhatsApp session
• Browser tool — For Google Maps scraping
• WhatsApp Business number connected to WAHA

Quick Start

1. Search for Leads

Use the browser tool to navigate to Google Maps:

https://www.google.com/maps/search/{sector}+{location}

Examples:

https://www.google.com/maps/search/veteriner+uşak
https://www.google.com/maps/search/kuaför+simav+kütahya
https://www.google.com/maps/search/diş+kliniği+istanbul
https://www.google.com/maps/search/auto+repair+london

Click each listing to extract: name, phone, rating, reviews, website, Instagram, hours.

2. Store Leads

Save as JSON:

[
    {
        "name": "Business Name",
        "phone": "905551234567",
        "rating": "4.8",
        "reviews": 120,
        "website": "example.com",
        "instagram": "instagram.com/handle",
        "hours": "Open · Closes 8 pm",
        "notes": "Key observations"
    }
]

Directory structure:

leads/
├── {city}/
│   ├── {sector}.json
│   ├── veteriner.json
│   ├── dis_klinigi.json
│   └── kuafor.json

3. Craft Pitch Messages

Personalize based on business profile. See references/pitch-templates.md for sector-specific templates.

Key personalization signals:

• No website → "online presence" angle
• Low rating → "customer satisfaction improvement" angle
• High reviews → "you're already popular, scale it" angle
• Has Instagram but no website → "convert followers to customers" angle

4. Send via WAHA

curl -X POST "http://localhost:3000/api/sendText" \
  -H "X-Api-Key: YOUR_WAHA_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session": "default",
    "chatId": "[e-mail]",
    "text": "Your personalized message here"
  }'

Sending rules:

• Minimum 2 minutes between messages (avoid WhatsApp spam detection)
• Maximum 15-20 messages per batch
• Send during business hours (09:00-18:00 local time)
• Never send the same template to the same number twice

5. Protect Against Bot Auto-Reply

If you have a WhatsApp bot (like a customer service bot), add all outreach numbers to an ignore list so the bot doesn't reply with irrelevant messages.

File-based ignore list (recommended):

Create data/outreach_ignore_lids.txt:

# Outreach targets - bot will NOT auto-reply
# Add both @lid IDs and phone numbers
905551234567
127517595824360

Webhook filter in your bot:

# In your WhatsApp webhook handler, before processing:
ignore_file = "data/outreach_ignore_lids.txt"
if os.path.exists(ignore_file):
    with open(ignore_file) as f:
        ignore_ids = {line.strip() for line in f if line.strip() and not line.startswith('#')}
    clean_id = from_id.replace("@lid","").replace("@c.us","")
    if clean_id in ignore_ids:
        # Don't auto-reply, but notify admin
        notify_admin(f"Outreach reply from {from_id}: {message}")
        return

Important: WAHA uses @lid format internally which differs from phone numbers. Always add BOTH the lid ID and the phone number to your ignore list.

Batch Send Script

For automated batch sending, use scripts/batch_send.sh:

scripts/batch_send.sh \
  --leads leads/usak/veteriner.json \
  --template references/pitch-templates.md \
  --sector veteriner \
  --waha-url http://localhost:3000 \
  --waha-key YOUR_KEY \
  --delay 120 \
  --ignore-file data/outreach_ignore_lids.txt

Sector-Specific Angles

See references/pitch-templates.md for full templates. Quick reference:

Sector	Pain Point	Our Solution
Salon/Kuaför	Missed calls during service	WhatsApp auto-appointment
Veteriner	Forgotten vaccine schedules	Auto vaccine reminders
Diş Kliniği	No-show appointments (30%+)	Appointment reminders
Emlakçı	Lead tracking chaos	Auto property matching
Oto Servis	Missed maintenance cycles	Service interval reminders
Restoran	Reservation no-shows	WhatsApp reservation + reminder
Fotoğrafçı	Client/shoot tracking	CRM + auto follow-up

Security

• No credentials in skill files — WAHA key passed as parameter or environment variable
• No direct config access — Uses OpenClaw CLI for any gateway operations
• Rate limiting built-in — Configurable delays prevent WhatsApp spam flags
• Ignore list is append-only — New outreach targets are added, never removed
• Admin notifications — All outreach replies forwarded to admin (Telegram/SMS/etc)

Tips

• Start with 10-15 leads per batch, scale up after testing response rates
• Personalized messages get 3-5x more replies than generic templates
• Best days: Tuesday-Thursday. Best times: 10:00-12:00, 14:00-16:00
• Follow up non-responders after 3-5 days with a shorter message
• Track conversion: lead → reply → demo → customer