← Back to Skills Marketplace
Skill Package
by
RazzleDazzleI
· GitHub ↗
· v1.0.0
· MIT-0
208
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install skill-package
Description
Automated lead generation pipeline that finds local businesses with weak/no websites, AI-generates custom demo sites, deploys to Vercel, and runs a 5-email c...
Usage Guidance
This skill performs broad, sensitive operations (cloning and running remote code, storing a GCP service-account JSON on disk, deploying sites with your Vercel token, and sending mass outreach with AgentMail). Before installing or providing any secrets: 1) Inspect the repository and exact commit the instructions will clone; do not run `npm install` or scripts until you've reviewed package.json and the code. 2) Use least-privilege credentials: create dedicated API keys/tokens with minimal scopes (restrict Vercel token to a single project, create a Google Cloud service account with only Sheets/Places permissions), and rotate/delete them if you stop using the skill. 3) Store service-account keys securely (avoid leaving them in plaintext in home directories) and prefer ephemeral or hosted credentials. 4) Run the pipeline in an isolated test environment (container or throwaway VM) first. 5) Verify email templates and legal compliance for unsolicited outreach (CAN-SPAM, local laws) to avoid account suspension or legal risk. 6) Ask the skill author to update the registry metadata to list all required env vars and config paths, pin the repo to a release/commit, and provide a vetted install artifact. If you cannot audit the remote code yourself, treat this skill as high-risk and avoid providing production credentials.
Capability Analysis
Type: OpenClaw Skill
Name: skill-package
Version: 1.0.0
The skill bundle (SKILL.md) describes an automated lead-generation system that requires high-privilege API tokens for Vercel, Google Cloud, and AgentMail. It directs the AI agent to execute local scripts and establish cron jobs for automated web deployment and cold email outreach. While the instructions are consistent with the stated business purpose, the high-privilege nature of automated deployment and communication, combined with the lack of source code for the referenced scripts (e.g., scripts/send-outreach.js), presents a significant security risk for credential exposure or unauthorized automated actions.
Capability Assessment
Purpose & Capability
The skill's stated purpose (discover leads, generate sites, deploy, and send outreach) is coherent with the things it actually does, but the metadata omits several sensitive items the SKILL.md requires. Metadata lists GOOGLE_PLACES_API_KEY, GOOGLE_API_KEY, VERCEL_TOKEN, AGENTMAIL_API_KEY and node, yet the SKILL.md also references GOOGLE_SHEET_ID, ANTHROPIC_API_KEY, OPENAI_API_KEY, a GCP service-account JSON file path, and other env vars. The mismatch (declared vs used credentials/config) is an incoherence worth flagging.
Instruction Scope
The SKILL.md directs cloning a public GitHub repository and running `npm install` and Node scripts that will scrape websites, call Google APIs, deploy to Vercel, and send outreach via AgentMail. It also instructs saving a GCP service-account JSON to a specific path (~/.openclaw/workspace/gcp-service-account.json) and configuring cron/systemd to run the pipeline. Those instructions cause the agent/container to fetch and execute arbitrary remote code and store sensitive keys on disk — scope goes beyond a small helper and includes broad system and network activity.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but the runtime instructions require `git clone` of an external repo and `npm install` — this downloads arbitrary code and dependencies from the network and writes them to disk. That is a high-risk install pattern unless the repository and exact release/commit are verified. The skill does not pin to releases or commit SHAs in the instructions.
Credentials
The skill asks for multiple sensitive credentials (Google Places/API keys, Vercel token, AgentMail API key) and implicitly requires additional secrets (Anthropic/OpenAI keys, Google Sheets ID, GCP service-account JSON) that are not declared in the manifest. These tokens grant broad capabilities (API access, deployment rights, ability to send emails) appropriate for the stated purpose but also carry abuse risk; the missing declarations and required on-disk service account key are disproportionate without explicit justification and least-privilege guidance.
Persistence & Privilege
always:false (good), but the instructions explicitly tell you to set up a poller as a systemd service or a cron job and to save service-account credentials on disk; this grants the pipeline persistent execution and ongoing ability to send emails and deploy sites. Autonomous invocation is allowed by default — combined with the other concerns this increases the blast radius. The skill does not request 'always:true', but it does guide installation of persistent processes.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-package - After installation, invoke the skill by name or use
/skill-package - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of lead-gen-website-pipeline: an end-to-end automated lead generation and outreach system for local business websites.
- Discovers and scores local business leads with Google Places API and saves to Google Sheets for approval.
- AI-generates a custom demo website per approved lead and deploys automatically to Vercel.
- Runs a 5-step cold email drip via AgentMail, targeting businesses with weak or no websites.
- Provides detailed run artifacts, visual QA, and sends notifications (including Discord option).
- Highly configurable for niches, city targeting, drip sequence, email templates, and design blueprints.
- Designed for low operating cost with transparent per-lead and monthly price estimates.
Metadata
Frequently Asked Questions
What is Skill Package?
Automated lead generation pipeline that finds local businesses with weak/no websites, AI-generates custom demo sites, deploys to Vercel, and runs a 5-email c... It is an AI Agent Skill for Claude Code / OpenClaw, with 208 downloads so far.
How do I install Skill Package?
Run "/install skill-package" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill Package free?
Yes, Skill Package is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Skill Package support?
Skill Package is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill Package?
It is built and maintained by RazzleDazzleI (@razzledazzlei); the current version is v1.0.0.
More Skills