📦 Lead Gen Pipeline — 自动获客
v1.0.0为网页设计机构打造的自动化本地潜在客户挖掘流程：自动发现无官网或网站失效的本地商家，并为其生成演示 HTML 站点，一键输出销售线索包。
0· 62·0 当前·0 累计
by @michelle447下载技能包
最后更新
2026/4/5
安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This skill automates web scraping, builds demo sites using real business names/phones, deploys those sites to a VPS, and sends personalized cold emails — but it declares no credentials or install steps. Before installing: 1) Ask the publisher which VPS credentials/SSH keys and which Gmail account the skill will use and how those are supplied; refuse to give your primary accounts until you verify. 2) Require the agent to run in interactive/manual mode for the first runs (no automatic emailing or ...详细分析 ▾
⚠ 用途与能力
The skill claims to find leads, build demo HTML sites, deploy them to a VPS, and send Gmail pitch emails. Those capabilities legitimately require access to external accounts (VPS credentials, an email account) and possibly other skills (site-cloner, gog). However the package declares no required environment variables, credentials, binaries, or install steps. That is inconsistent: deployment and automated email sending normally require explicit credential/config declarations.
⚠ 指令范围
SKILL.md instructs the agent to: run web_search and web_fetch to scrape business contact info, generate demo sites using real business names/phones, save them to demo-sites/, deploy to a VPS (using another skill's 'VPS deploy pattern'), and send personalized cold emails via the gog (Gmail) skill. These are broad actions (web scraping, storing PII in leads.md, remote deployment, sending outbound email). The instructions reference cross-skill actions and external endpoints but do not limit or describe required permissions, nor do they require explicit user confirmation before sending messages — giving the agent wide discretion.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files. That minimizes disk-write/install risk. There are no download URLs or packaged binaries to evaluate.
⚠ 凭证需求
No environment variables or primary credentials are declared, yet the workflow depends on: VPS credentials (or SSH keys) to deploy demo sites, and Gmail (or an email-sending credential) to send pitches. The skill also writes and reads ~/workspace/leads.md (which will contain scraped PII). The lack of declared credential requirements is disproportionate and hides what secrets the agent will need or attempt to use.
ℹ 持久化与权限
always:false (normal). Autonomous invocation is allowed (disable-model-invocation:false), so if installed the agent could automatically perform multi-step actions (scraping, deploying, emailing) without further prompts. That autonomous ability combined with the undeclared credential needs increases operational risk and potential for unintended mass emailing or unauthorized deployments; proceed with controls (explicit prompts, test account) if you install.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/5
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install mjw-lead-gen-pipeline
镜像加速npx clawhub@latest install mjw-lead-gen-pipeline --registry https://cn.longxiaskill.com镜像同步中