Cold Email Outreach

Automate B2B cold email outreach by sourcing leads from Apollo, verifying with Hunter.io, and uploading to Instantly for a 3-email drip campaign in one command.

This skill appears to implement the advertised pipeline but has a few issues you should address before using it: - Metadata vs reality: The registry metadata says no credentials are required, but the scripts require API keys (Instanly/Hunter and optionally Apollo) stored in config.js. Don't put keys into a repo; create config.js locally and keep it out of version control. - Missing file: SKILL.md mentions pipeline.js (API scrape mode) but that file isn't included. If you need API scraping you should request or review that missing file before running anything that claims to use it. - Logic bug: verifyEmail treats any non-200 response from Hunter as "valid" (the code returns true when res.status !== 200). That means transient Hunter failures can cause invalid emails to be uploaded — fix the logic to treat non-200 responses as failures or retry. - Data safety: the script reads whatever CSV you pass and will POST those email addresses to Instantly. Ensure you have permission to contact those addresses and comply with anti-spam law and terms of service. - Secrets and storage: storing bearer tokens in plaintext config.js is convenient but risky. Keep the file local, add it to .gitignore, and rotate tokens if they are ever committed accidentally. - Testing and rate limits: test with a small CSV first, confirm Hunter/Instantly quotas and rate limits, and verify campaign configuration in Instantly before launching bulk sends. If you want to proceed, request the missing pipeline.js (if you need Apollo API scraping), patch the verifyEmail logic to handle non-200 responses safely, and ensure API keys are handled securely. If you are unsure, do not run the script on production data until you or a developer have audited these issues.

Type: OpenClaw Skill Name: skill-cold-email-outreach Version: 1.0.0 The skill bundle is designed for automated cold email outreach, integrating with Apollo, Hunter.io, and Instantly.ai. All code and documentation align with this stated purpose, requiring API keys for legitimate interactions with these services. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, arbitrary code execution, persistence mechanisms, or prompt injection attempts against the AI agent. File I/O and network requests are confined to the skill's core functionality.