WhatsApp Lead Hunter

Automated lead generation and WhatsApp outreach system. Scrape business leads from Google Maps by sector and location, generate personalized pitch messages,...

This skill appears to do what it claims, but consider the following before installing or running it: - Legal/ethical risk: scraping Google Maps and sending cold WhatsApp messages can violate Google’s terms of service and local spam/privacy laws. Confirm you have the right to collect and message these contacts. - Data exfiltration/notification endpoints: the webhook snippet references notify_admin (Telegram/SMS/etc.) but doesn't specify where notifications go — review any admin notification configuration to ensure message content/phone numbers are not sent to untrusted external endpoints. - WAHA API key security: the WAHA key is required at runtime; treat it as a secret and only point the script to a WAHA instance you control (localhost or a secured host). - Test in dry-run mode first: the script supports --dry-run; use it and small batches (10–15 leads) as suggested before scaling. - Respect rate limits and recipients: keep delays and batch sizes conservative and maintain an ignore list as recommended to avoid bot conflicts and account suspension. - Documentation mismatch: the SKILL.md mentions OpenClaw CLI for gateway operations but provides no examples — clarify this before relying on any automated gateway actions. If you are comfortable with these operational and compliance concerns and you control the WAHA instance and notification endpoints, the skill is internally coherent. If any of these points are unclear or unacceptable, do not enable the skill until they are resolved.

Type: OpenClaw Skill Name: whatsapp-lead-hunter Version: 1.0.0 The skill provides a lead generation and WhatsApp outreach system using Google Maps and the WAHA API. While the logic is aligned with its stated purpose, the `scripts/batch_send.sh` script contains vulnerabilities, specifically potential shell injection in a Python one-liner (`open('$LEADS')`) and a lack of input sanitization when processing lead data (e.g., business names) through `sed` commands. These flaws allow for unintended execution or script failure if lead data or filenames are maliciously crafted, meeting the criteria for a suspicious classification despite the lack of clear malicious intent.