Generect API
v1.0.1Search B2B leads and companies, find/validate emails via Generect Live API. Use when the user needs to find people by job title/company/industry, search companies by ICP, generate business emails from name+domain, or validate email addresses. Covers lead generation, prospecting, enrichment, and email discovery workflows.
⭐ 0· 863·0 current·0 all-time
byAndrii Kolpakov@vokaplok
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and the included CLI script clearly require a GENERECT_API_KEY to call api.generect.com — appropriate for a lead-generation integration. However the registry metadata lists no required environment variables or primary credential, which is inconsistent and may hide the actual credential requirement from users/automated installers. The skill's stated purpose (lead/email discovery) is otherwise aligned with its requests.
Instruction Scope
The runtime instructions are narrowly scoped to calling Generect endpoints and returning results; they don't instruct reading unrelated local files or secrets. A minor issue: SKILL.md mentions an MCP server and an npx command (npx -y generect-ultimate-mcp@latest) — that would download and run remote code if followed, which expands scope beyond simple API calls and should be treated cautiously.
Install Mechanism
There is no formal install spec (instruction-only), and the only shipped code is a small bash wrapper that uses curl. That is low risk. However SKILL.md suggests using npx to fetch a package from npm — executing npx will pull and run remote code (higher-risk) if the user/agent follows that advice.
Credentials
Functionality legitimately requires a single API key (GENERECT_API_KEY). The problem is the registry metadata does not declare this required environment variable or a primary credential, while the script and README require it. This omission is disproportionate because it hides the need to provide a secret and could lead to silent failures or unexpected prompts. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request persistent presence (always: false) and does not modify other skills or system settings. It can be invoked by the agent (normal behavior) but has no elevated platform privileges.
What to consider before installing
This skill otherwise appears coherent for B2B lead and email lookup, but proceed with caution. Key points: (1) The SKILL.md and included script require GENERECT_API_KEY, but the registry metadata omits that — verify you or your org will provide only a limited API key and that you understand the billing/permissions tied to it. (2) The skill's origin/homepage is unknown; confirm the service (api.generect.com) and its terms/privacy before sending sensitive data. (3) The SKILL.md suggests running npx generect-ultimate-mcp@latest — running npx will download and execute remote code; avoid doing this unless you trust the package source. (4) The CLI script simply posts JSON to api.generect.com; requests will query LinkedIn/third-party data in real time (may include scraped/enriched personal data) — check compliance with your policies. If you plan to install/use the skill, ask the publisher to correct the registry metadata to declare GENERECT_API_KEY explicitly and provide a trustworthy homepage or docs; prefer creating a scoped/test API key before giving production credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk97fsgepf4y0ksrnfqjq6qjjth80zv86
License
MIT-0
Free to use, modify, and redistribute. No attribution required.