← Back to Skills Marketplace
mchensf

badgebot

by Mark Chen · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
87
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install badgebot
Description
Monitor a Slack channel for images/text of leads (badges, business cards), extract data, enrich with Apollo.io API, let Apollo auto-sync to HubSpot, search H...
README (SKILL.md)

Slack Lead Scanner

Monitor #leadscanner for new images/text, process as leads via Apollo + HubSpot, reply in-thread. Also check Slack DM replies to update HubSpot contacts.

Setup

  • SLACK_TOKEN in ~/.openclaw/credentials/slack-bot-token (xoxb- token)
  • Apollo key in ~/.openclaw/credentials/apollo-api-key
  • HubSpot token in ~/.openclaw/credentials/hubspot-api-key
  • State file: ~/clawd/memory/slack-lead-scanner-state.json
  • Portal ID: 43856876
  • Channel: #leadscanner (C0AQAJ8VD8A)

State File Schema

{
  "last_ts": 1234567890,
  "processed_ids": ["msg_ts_1", "msg_ts_2"],
  "channel_id": "C0AQAJ8VD8A",
  "pending_dm_replies": [
    {
      "dm_ts": "1234567890.123456",
      "hubspot_contact_id": "12345",
      "contact_name": "John Doe"
    }
  ]
}

Polling Workflow

Part 1: Process New #leadscanner Messages

  1. Load state from ~/clawd/memory/slack-lead-scanner-state.json
  2. Fetch messages: curl -H "Authorization: Bearer $SLACK_TOKEN" "https://slack.com/api/conversations.history?channel=C0AQAJ8VD8A&oldest=[last_ts]&limit=50"
  3. Filter: ts > last_ts, not in processed_ids, has files or non-empty text
  4. For each new message: a. Download image: curl -H "Authorization: Bearer $SLACK_TOKEN" "[file.url_private_download]" -o /tmp/lead-[ts].jpg b. Analyze with image tool: "Extract structured data from this badge or business card. Return JSON: {first_name, last_name, company, title, email, phone, notes}" c. Append message.text to notes d. Dedup: Search HubSpot first by firstname+lastname+company — if exists, skip enrich, go to step (g) e. Enrich via Apollo: curl -X POST -H "Content-Type: application/json" -d '{"api_key":"[KEY]","first_name":"[f]","last_name":"[l]","organization_name":"[co]","title":"[t]","reveal_personal_emails":true,"reveal_phone_number":true}' https://api.apollo.io/api/v1/people/match f. Sleep 10s, then search HubSpot for new contact (sort by createdate DESC, filter name+company) g. Get contact id, build link: https://app.hubspot.com/contacts/43856876/contact/[id] h. Send DM to Mark (user:U03H7C6HW5B) with formatted message (see Reply Format below) i. Track DM timestamp from response, add to pending_dm_replies in state j. React ✅ on original #leadscanner message k. Add msg ts to processed_ids, update last_ts l. Cleanup: rm /tmp/lead-[ts].jpg

Part 2: Check DM Replies for HubSpot Updates

  1. For each entry in pending_dm_replies: a. Fetch thread replies: curl -H "Authorization: Bearer $SLACK_TOKEN" "https://slack.com/api/conversations.replies?channel=[DM_CHANNEL_ID]&ts=[dm_ts]" b. Filter replies that are from the user (not the bot itself) and not yet processed c. Parse reply text as a natural-language HubSpot update instruction, e.g.:

    • "update title to VP of Sales" → jobtitle
    • "wrong email, it's [email protected]" → email
    • "company is Acme Corp" → company
    • "phone is 415-555-1234" → phone
    • "add note: met at SaaStr" → note (create HubSpot note via /crm/v3/objects/notes) d. Apply update via HubSpot PATCH: curl -X PATCH -H "Authorization: Bearer $HUBSPOT_TOKEN" -H "Content-Type: application/json" -d '{"properties":{"[field]":"[value]"}}' "https://api.hubapi.com/crm/v3/objects/contacts/[hubspot_contact_id]" e. Reply in thread: "✅ Updated [field] to [value] for [contact_name]." f. If unrecognized instruction, reply: "❓ I didn't understand that. Try: 'update title to [value]' or 'email is [value]'"
  2. Write updated state back to ~/clawd/memory/slack-lead-scanner-state.json

  3. Log to memory/YYYY-MM-DD.md

Reply Format (DM to Mark)

Use Slack line breaks (
) between fields:

*[Full Name]*
[Title]
[Company]
📧 [Email]
📞 [Phone]
🔗 \x3Chttps://app.hubspot.com/contacts/43856876/contact/[id]|View in HubSpot>

_Reply to this message to update any field in HubSpot._

HubSpot Field Mappings

Natural language HubSpot property
name / first name / last name firstname / lastname
title / job title / role jobtitle
company / org company
email email
phone phone
note / notes create note object

Error Handling

  • No Apollo match: send DM anyway with extracted data, note "No enrichment match"
  • No HubSpot match after sleep: send DM with "Sync pending - check HubSpot later", omit link
  • API errors: Log and DM "Error processing: [msg]" with ❌ react
  • Unknown DM reply: Reply with ❓ and guidance

Notes

  • Use haiku model for cost efficiency
  • Rate limits: Slack ~1 call/sec, Apollo per plan, HubSpot 100 req/10s
  • Never log or output tokens
  • Get DM channel ID for direct messages: it's a conversations.open response for user U03H7C6HW5B
Usage Guidance
Key things to consider before installing: 1) Metadata mismatch: ask the publisher why the registry lists no required credentials while the instructions require Slack, Apollo, and HubSpot tokens stored in specific files. Prefer skills that declare required credentials explicitly. 2) Least privilege: create dedicated, minimal-scope API tokens (Slack bot token limited to the single channel and DM actions, Apollo/HubSpot tokens scoped as narrowly as possible). Avoid using owner/global admin tokens. 3) Test in staging: run the skill in a non-production/test workspace and portal to verify behavior and that only intended messages are read/updated. 4) Inspect provenance: request source code or a homepage from the publisher (none is provided). Without source or a trusted publisher, exercise extra caution. 5) Data exposure and compliance: the skill enriches with personal emails (reveal_personal_emails=true) and stores lead data in local state and logs — ensure this matches your data-handling and privacy policies. 6) Rotation & monitoring: if you try it, use short-lived tokens where possible and rotate them after testing; monitor API call patterns and logs for unexpected activity. If the publisher cannot explain the missing metadata or provide source, treat the skill as higher risk and avoid installing it with privileged credentials.
Capability Analysis
Type: OpenClaw Skill Name: badgebot Version: 1.0.0 The 'slack-lead-scanner' skill in SKILL.md automates lead enrichment and CRM synchronization by monitoring Slack messages and updating HubSpot. It is classified as suspicious because it requires access to multiple sensitive API tokens (Slack, Apollo, HubSpot) stored in the filesystem and performs automated PATCH operations on a HubSpot CRM based on natural language interpretation of Slack DM replies. This pattern introduces a risk of unintended or unauthorized data modification in the HubSpot portal (ID: 43856876) if the agent misinterprets user input or if the Slack communication channel is compromised.
Capability Assessment
Purpose & Capability
The SKILL.md describes a Slack→Apollo→HubSpot lead-processing pipeline which legitimately needs Slack, Apollo, and HubSpot credentials. However the registry lists no required env vars or primary credential while the instructions explicitly require reading tokens from specific files (e.g., ~/.openclaw/credentials/slack-bot-token, ~/.openclaw/credentials/apollo-api-key, ~/.openclaw/credentials/hubspot-api-key). That metadata mismatch is an inconsistency and should be explained by the publisher.
Instruction Scope
Instructions are detailed and mostly limited to the stated purpose (poll a specific Slack channel, download attachments to /tmp, call Apollo and HubSpot APIs, DM a hard-coded user, maintain a state file under ~/clawd). Concerns: (1) hard-coded Slack channel ID (C0AQAJ8VD8A), user ID (U03H7C6HW5B), and Portal ID (43856876) — indicates targeting a specific org; (2) instructions rely on reading credentials from files in the user's home without those files being declared in the registry; (3) the skill will read and write local state and log files which may contain identifiable lead data. These are within the task scope but require explicit disclosure.
Install Mechanism
No install spec and no code files — this is an instruction-only skill. That reduces some risk because nothing is downloaded or written by an installer step. The runtime instructions still perform network calls and file I/O.
Credentials
The runtime needs sensitive credentials (Slack bot token, Apollo API key, HubSpot token) — which are proportionate to the described integration. However the registry declares no required env vars or primary credential, and the SKILL.md requires tokens stored in specific local paths instead of declared env vars. Also the Apollo call sets reveal_personal_emails=true which requests personal contact data; users should confirm they have the legal/organizational right to enrich and store such data.
Persistence & Privilege
The skill does not request always:true and will not be force-included. It does persist state under ~/clawd/memory/slack-lead-scanner-state.json and write logs to memory/YYYY-MM-DD.md — behavior expected for a poller. It does not claim to modify other skills or system-wide agent settings.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install badgebot
  3. After installation, invoke the skill by name or use /badgebot
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of Slack Lead Scanner — automate lead extraction, enrichment, and syncing between Slack, Apollo, and HubSpot. - Monitors #leadscanner for lead images/text, extracts and enriches contact info, and syncs to HubSpot. - Sends Slack DM summaries with HubSpot links, enabling in-thread updates to contacts. - Handles user replies in Slack DMs to update HubSpot fields (e.g., title, email, notes). - Maintains local state for tracking processed messages and pending replies. - Includes full setup guide, state schema, field mappings, and robust error handling.
Metadata
Slug badgebot
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is badgebot?

Monitor a Slack channel for images/text of leads (badges, business cards), extract data, enrich with Apollo.io API, let Apollo auto-sync to HubSpot, search H... It is an AI Agent Skill for Claude Code / OpenClaw, with 87 downloads so far.

How do I install badgebot?

Run "/install badgebot" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is badgebot free?

Yes, badgebot is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does badgebot support?

badgebot is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created badgebot?

It is built and maintained by Mark Chen (@mchensf); the current version is v1.0.0.

💬 Comments