← 返回 Skills 市场

GHL CRM for Realtors

Name: GHL CRM for Realtors
Author: danielfoch

作者 danielfoch · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

795

总下载

当前安装

版本数

在 OpenClaw 中安装

/install ghl-crm-for-realtors

功能描述

Manage realtor tasks in GoHighLevel CRM including contact search and updates, pipeline tracking, messaging, calendar slots, and workflow enrollment via API v2.

使用说明 (SKILL.md)

GHL CRM for Realtors

Use this skill when a user wants realtor CRM actions in GoHighLevel (GHL), including lead follow-up, pipeline movement, appointment booking context, and messaging workflows.

Required Environment

Set these variables before running the scripts:

HIGHLEVEL_TOKEN (Private Integration token)
HIGHLEVEL_LOCATION_ID (sub-account location ID)

Optional runtime variables:

PYTHONUNBUFFERED=1

Setup

If the user asks to connect or set up GHL, run:

python3 scripts/setup-wizard.py

The wizard validates credentials and tests API connectivity.

Primary Script

Use the helper script for direct actions:

python3 scripts/ghl-api.py \x3Ccommand> [args...]

Common commands for realtor workflows:

test_connection
search_contacts [query]
get_contact [contact_id]
create_contact [json]
update_contact [contact_id] [json]
list_opportunities
list_pipelines
list_conversations
send_message [contact_id] [message]
list_calendars
get_free_slots [calendar_id] [start_date] [end_date]
list_workflows
add_to_workflow [contact_id] [workflow_id]

Realtor-Focused Playbooks

New Lead Intake

search_contacts to prevent duplicates.
If not found, create_contact with source tags (for example: buyer, zillow, open-house).
Add next-step task/note using supported contact endpoints.

Pipeline Progress

list_opportunities to inspect active deals.
Move stage using the opportunity update command path in ghl-api.py.
Confirm stage and status in response payload.

Follow-Up Messaging

Resolve contact first (search_contacts or get_contact).
Send message with send_message.
Re-check conversation history with list_conversations.

Appointment Assist

list_calendars
get_free_slots for date range.
Use the calendar endpoints in script for appointment creation if requested.

Safety Rules

Never print or echo raw tokens in chat output.
Prefer dry informational reads before write actions when intent is ambiguous.
Validate contact/opportunity IDs from GHL responses instead of guessing.
If an API error returns 401/403, stop and ask for corrected scopes or token.

References

Load these only as needed:

references/contacts.md
references/opportunities.md
references/conversations.md
references/calendars.md
references/troubleshooting.md

安全使用建议

This skill looks like a plausible GHL integration, but take these precautions before installing: - Verify provenance: the source/homepage is unknown; confirm you trust the owner before supplying credentials. - Provide a dedicated Private Integration token with the minimum scopes needed (contacts.readonly, conversations.readonly/write, calendars, etc.) rather than a high-privilege account token. Rotate or revoke the token after testing. - Do not paste your token into chat or public logs. Although the setup script masks the token display, the troubleshooting docs include examples that echo $HIGHLEVEL_TOKEN — avoid running those echo commands publicly. - Because the registry metadata omits required env vars, ask the publisher to correct the manifest to declare HIGHLEVEL_TOKEN and HIGHLEVEL_LOCATION_ID so you can review permissions up front. - Test in a safe environment (a throwaway sub-account or token with limited scopes) before using this against production data. If you cannot verify the publisher or are uncomfortable supplying a token, do not install or run the scripts.

功能分析

Type: OpenClaw Skill Name: ghl-crm-for-realtors Version: 1.0.0 The skill is classified as suspicious due to a vulnerability in `scripts/ghl-api.py` where JSON input for API calls (e.g., `create_contact`, `update_contact`) is directly parsed from command-line arguments (`sys.argv`) using `json.loads()` without further content validation. While path segments are sanitized with `_validate_id`, this lack of sanitization for the JSON request body creates a prompt injection risk against the AI agent. An attacker could craft malicious JSON via prompt injection, leading the agent to execute harmful or unintended API actions on the GoHighLevel platform, such as data corruption or unauthorized modifications, even though the script's core intent is to provide legitimate API access.

能力评估

ℹ Purpose & Capability

The code and SKILL.md are coherent with the stated purpose: both scripts interact only with GoHighLevel (services.leadconnectorhq.com) and implement contact, conversation, calendar, and opportunity endpoints. However, the registry metadata lists no required environment variables while the SKILL.md and both scripts clearly require HIGHLEVEL_TOKEN and HIGHLEVEL_LOCATION_ID. That metadata omission is an inconsistency that should be corrected.

ℹ Instruction Scope

Runtime instructions and scripts are narrowly scoped to the GHL API and related references; they do not attempt to read unrelated filesystem paths or contact unknown endpoints. Minor scope issues: references/troubleshooting.md shows example commands that echo $HIGHLEVEL_TOKEN (which would print the raw token), while SKILL.md's Safety Rules say 'Never print or echo raw tokens' — this contradiction could lead to accidental token exposure during debugging or by less-knowledgeable users.

✓ Install Mechanism

No install spec; this is an instruction-only skill with included Python scripts using only standard library modules (urllib, json, re, etc.). There are no external downloads, package installers, or executable creation steps — low installation risk.

⚠ Credentials

The skill legitimately needs a Private Integration token (HIGHLEVEL_TOKEN) and a location ID (HIGHLEVEL_LOCATION_ID) to operate. These are sensitive credentials and are appropriately the only secrets required. However, the registry metadata failing to declare these env vars is a red flag for transparency. Also, the troubleshooting docs include examples that would print the token, increasing accidental exposure risk if users follow them without caution.

✓ Persistence & Privilege

The skill does not request always:true or any elevated persistent platform privileges. It does not modify other skills or system-wide agent settings. It is user-invocable and allows autonomous invocation (platform default), which is expected for this kind of skill.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install ghl-crm-for-realtors
安装完成后，直接呼叫该 Skill 的名称或使用 /ghl-crm-for-realtors 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Initial release of GHL CRM for Realtors skill. - Provides GoHighLevel CRM integration for realtor workflows: contact management, pipeline actions, messaging, calendar, and workflow enrollment. - Includes setup wizard and command-line helpers for common realtor tasks. - Enforces safety rules for credentials and API responses. - Supplies playbooks for lead intake, pipeline progress, follow-up messaging, and appointment scheduling.

元数据

Slug ghl-crm-for-realtors

版本 1.0.0

许可证 —

累计安装 2

当前安装数 2

历史版本数 1

常见问题