← 返回 Skills 市场
Skill Package
作者
RazzleDazzleI
· GitHub ↗
· v1.0.0
· MIT-0
208
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install skill-package
功能描述
Automated lead generation pipeline that finds local businesses with weak/no websites, AI-generates custom demo sites, deploys to Vercel, and runs a 5-email c...
安全使用建议
This skill performs broad, sensitive operations (cloning and running remote code, storing a GCP service-account JSON on disk, deploying sites with your Vercel token, and sending mass outreach with AgentMail). Before installing or providing any secrets: 1) Inspect the repository and exact commit the instructions will clone; do not run `npm install` or scripts until you've reviewed package.json and the code. 2) Use least-privilege credentials: create dedicated API keys/tokens with minimal scopes (restrict Vercel token to a single project, create a Google Cloud service account with only Sheets/Places permissions), and rotate/delete them if you stop using the skill. 3) Store service-account keys securely (avoid leaving them in plaintext in home directories) and prefer ephemeral or hosted credentials. 4) Run the pipeline in an isolated test environment (container or throwaway VM) first. 5) Verify email templates and legal compliance for unsolicited outreach (CAN-SPAM, local laws) to avoid account suspension or legal risk. 6) Ask the skill author to update the registry metadata to list all required env vars and config paths, pin the repo to a release/commit, and provide a vetted install artifact. If you cannot audit the remote code yourself, treat this skill as high-risk and avoid providing production credentials.
功能分析
Type: OpenClaw Skill
Name: skill-package
Version: 1.0.0
The skill bundle (SKILL.md) describes an automated lead-generation system that requires high-privilege API tokens for Vercel, Google Cloud, and AgentMail. It directs the AI agent to execute local scripts and establish cron jobs for automated web deployment and cold email outreach. While the instructions are consistent with the stated business purpose, the high-privilege nature of automated deployment and communication, combined with the lack of source code for the referenced scripts (e.g., scripts/send-outreach.js), presents a significant security risk for credential exposure or unauthorized automated actions.
能力评估
Purpose & Capability
The skill's stated purpose (discover leads, generate sites, deploy, and send outreach) is coherent with the things it actually does, but the metadata omits several sensitive items the SKILL.md requires. Metadata lists GOOGLE_PLACES_API_KEY, GOOGLE_API_KEY, VERCEL_TOKEN, AGENTMAIL_API_KEY and node, yet the SKILL.md also references GOOGLE_SHEET_ID, ANTHROPIC_API_KEY, OPENAI_API_KEY, a GCP service-account JSON file path, and other env vars. The mismatch (declared vs used credentials/config) is an incoherence worth flagging.
Instruction Scope
The SKILL.md directs cloning a public GitHub repository and running `npm install` and Node scripts that will scrape websites, call Google APIs, deploy to Vercel, and send outreach via AgentMail. It also instructs saving a GCP service-account JSON to a specific path (~/.openclaw/workspace/gcp-service-account.json) and configuring cron/systemd to run the pipeline. Those instructions cause the agent/container to fetch and execute arbitrary remote code and store sensitive keys on disk — scope goes beyond a small helper and includes broad system and network activity.
Install Mechanism
There is no formal install spec in the registry (instruction-only), but the runtime instructions require `git clone` of an external repo and `npm install` — this downloads arbitrary code and dependencies from the network and writes them to disk. That is a high-risk install pattern unless the repository and exact release/commit are verified. The skill does not pin to releases or commit SHAs in the instructions.
Credentials
The skill asks for multiple sensitive credentials (Google Places/API keys, Vercel token, AgentMail API key) and implicitly requires additional secrets (Anthropic/OpenAI keys, Google Sheets ID, GCP service-account JSON) that are not declared in the manifest. These tokens grant broad capabilities (API access, deployment rights, ability to send emails) appropriate for the stated purpose but also carry abuse risk; the missing declarations and required on-disk service account key are disproportionate without explicit justification and least-privilege guidance.
Persistence & Privilege
always:false (good), but the instructions explicitly tell you to set up a poller as a systemd service or a cron job and to save service-account credentials on disk; this grants the pipeline persistent execution and ongoing ability to send emails and deploy sites. Autonomous invocation is allowed by default — combined with the other concerns this increases the blast radius. The skill does not request 'always:true', but it does guide installation of persistent processes.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-package - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-package触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of lead-gen-website-pipeline: an end-to-end automated lead generation and outreach system for local business websites.
- Discovers and scores local business leads with Google Places API and saves to Google Sheets for approval.
- AI-generates a custom demo website per approved lead and deploys automatically to Vercel.
- Runs a 5-step cold email drip via AgentMail, targeting businesses with weak or no websites.
- Provides detailed run artifacts, visual QA, and sends notifications (including Discord option).
- Highly configurable for niches, city targeting, drip sequence, email templates, and design blueprints.
- Designed for low operating cost with transparent per-lead and monthly price estimates.
元数据
常见问题
Skill Package 是什么？
Automated lead generation pipeline that finds local businesses with weak/no websites, AI-generates custom demo sites, deploys to Vercel, and runs a 5-email c... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 208 次。
如何安装 Skill Package？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-package」即可一键安装，无需额外配置。
Skill Package 是免费的吗？
是的，Skill Package 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Skill Package 支持哪些平台？
Skill Package 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Package？
由 RazzleDazzleI（@razzledazzlei）开发并维护，当前版本 v1.0.0。
推荐 Skills