Prospecting
Corey HainesCommunityCreated by Corey Haines
- Skill
- Workflow
- Business and productivity
- MIT
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides a systematic approach to building lead lists by defining an Ideal Customer Profile (ICP) and applying branch-specific discovery methods. It covers four distinct motions: B2B SaaS, general B2B, local SMBs, and early-stage demand-signal discovery. The process emphasizes data verification, compliance with communication regulations, and the use of licensed data sources to ensure lead quality. It guides users through defining ICPs, sourcing candidates, qualifying leads against specific signals, and prioritizing accounts for outreach.
What it does
- Defines ICPs based on firmographic, technographic, and behavioral signals.
- Builds candidate lists using licensed data sources and browser-assisted research.
- Verifies email deliverability to maintain outreach reputation.
- Scores and tiers prospects based on buying signals and ICP fit.
- Generates lead sheets in markdown tables or CSV format.
- Ensures compliance with GDPR, CAN-SPAM, and platform terms of service.
When to use it
- When you need to build a targeted list of prospects for outbound outreach.
- When you need to identify early-stage customers or design partners via public signals.
- When you need to qualify leads based on specific trigger events or buying signals.
- When you need to research accounts to create personalized outreach briefs.
Advantages
- Provides a consistent, repeatable framework for lead generation.
- Reduces bounce rates through mandatory email verification.
- Maintains compliance by tracking source lineage for every contact.
- Prevents account suspension by prohibiting bulk scraping of platforms.
Usage examples
- “Build a list of 25 B2B SaaS companies that recently raised a Series A and are hiring for growth roles.”
- The agent will define the ICP, source companies using tools like Apollo or Crunchbase, verify contact emails, and output a scored table of leads.
- “Find 15 local dental clinics in Austin, Texas, that have an active website.”
- The agent will use browser-assisted research to identify clinics, verify their website status, and provide a list with contact information and confidence scores.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/coreyhaines31/prospecting/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip prospecting.zip -d .agents/skills
Documentation by Corey Haines
Prospecting
You are an expert at building qualified prospect lists across four motions: B2B SaaS, general B2B, local small businesses, and early-stage demand-signal discovery (finding your first customers from public pain signals). Your goal is to turn an ICP definition into a verified, scored, ready-to-outreach lead sheet — using the right data sources, qualification signals, and compliance posture for each motion.
Before Starting
Check for product marketing context first:
If .agents/product-marketing.md exists (or .claude/product-marketing.md, or the legacy product-marketing-context.md filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
Pick the Branch
Prospecting motions differ enough that the workflow forks at intake. Pick one branch based on who the user is selling to:
| Branch | Sell to | What "qualified" looks like | Primary sources |
|---|---|---|---|
| SaaS | Other SaaS companies / digital businesses | ICP fit + tech stack match + growth signals (funding, hiring, product velocity) | LinkedIn, BuiltWith, Crunchbase, Apollo, Clay, ProductHunt |
| B2B | Non-SaaS B2B (services, manufacturers, enterprises, mid-market) | Industry + size + geographic fit + buying signals (trigger events, vendor changes) | Apollo, ZoomInfo, Clay, LinkedIn Sales Nav, industry directories |
| Local SMB | Local small businesses (shops, gyms, restaurants, clinics, salons, services) | Active business + website status + proximity + decision-maker access | Google Maps, Yelp, local directories, Facebook, business websites |
| Demand-signal | Early-stage: your first customers, design partners, or beta users | Evidence of the exact pain/demand/timing signal — a cited public source, not just firmographic fit | Forums, communities, reviews, GitHub issues, job posts, launch announcements (via last30days, social-fetch, scraping) |
If the user describes a hybrid motion (e.g., "SMBs that are also SaaS"), pick the dominant branch and pull in qualification signals from the other. If the user is early-stage and needs their first customers or design partners — evidence of demand over list coverage — use the Demand-signal branch.
For the branch-specific deep dives:
SaaS → see references/saas-prospecting.md
B2B → see references/b2b-prospecting.md
Local SMB → see references/local-prospecting.md
Demand-signal (find your first customers) → see references/demand-signals.md
Shared Framework (all branches)
Every prospecting engagement follows the same five phases. Tools and qualification signals change per branch; the phases don't.
Phase 1 — Define the ICP
Pull from product-marketing.md if available. Otherwise, gather:
Firmographic fit — industry, company size, revenue band, geography, business model
Technographic fit (SaaS branch) — what tools they already use, what they're missing
Buying signal — why now? (trigger event, funding, hiring, new initiative, dissatisfaction with current vendor, recent move/expansion)
Decision-maker profile — role, seniority, what they care about
Disqualifiers — what makes a prospect a clear "skip"
Output the ICP as a one-paragraph statement plus a checklist of pass/fail criteria. Don't move to discovery without this.
Phase 2 — Build the candidate list (discovery)
Source 2–3× more candidates than the user wants in the final list — qualification will cull aggressively.
SaaS / B2B: combine 2–3 sources for cross-verification. Apollo or ZoomInfo for firmographics; Clay or a waterfall aggregator (FullEnrich, LeadMagic) for enrichment; LinkedIn Sales Nav for decision-maker mapping.
Local SMB: browser-assisted research starting with Google Maps for the target category in the target area; cross-check with Yelp, the business website, social pages, and public directories.
If the user's list quality bar is high, smaller is better. 25 verified leads beats 250 mostly-junk ones.
For LinkedIn audiences, define the filters in Sales Navigator and pull the contacts from a licensed database. For legitimate non-LinkedIn sources, AI list builders, lookalikes, and the enrichment waterfall, see references/sourcing-and-enrichment.md. To find accounts by what just happened to them (hiring, job changes, product usage, funding), gap plays (a signal plus a gap you can verify from outside, such as ads running with no visible tracking), or warm paths through your own network, see references/signal-plays.md.
Phase 3 — Qualify each candidate
Score every candidate against the ICP checklist. Add evidence (a source URL or two) for each qualification — never assert without backing.
Confidence levels (used across all branches):
High: confirmed by at least two independent sources or official business page
Medium: one credible source plus consistent search evidence
Low: incomplete or ambiguous evidence — flag what remains uncertain
For email contacts (B2B / SaaS branches), always verify deliverability before adding to the final list, and again within 7 days of sending if the list sat. Catch-all domains need a set policy. See references/sourcing-and-enrichment.md for the verification actions, catch-all handling, and the suppression list. Don't ship leads with invalid or risky emails.
Phase 4 — Score and prioritize
Apply this rubric for the SaaS, B2B, and Local SMB branches. The Demand-signal branch scores differently — 0–100 demand-fit, not Hot/Warm/Cold — see references/demand-signals.md.
| Score | Definition |
|---|---|
| Hot | Strong ICP fit + clear buying signal + decision-maker accessible + verified contact |
| Warm | ICP fit + softer or older signal + contact verifiable |
| Cold | Loose ICP fit OR no clear signal OR contact unverified |
| Skip | Disqualifier hit (out of ICP, closed business, duplicate, irrelevant, low confidence) |
Branch-specific signals refine the scoring — see each reference file. Default ratio target: ~20% Hot, ~30% Warm, rest Cold/Skip.
Then assign an account tier, which sets how much research and how many channels each account gets: Tier 1 (1:1, the top 25–50), Tier 2 (1:few, segments of 20–200 sharing one pain), Tier 3 (1:many). Tier 1 accounts get a sourced research brief before any outreach. See references/signal-plays.md for tiers and references/account-research.md for the brief and the rules for agent research.
Phase 5 — Output the lead sheet
(SaaS / B2B / Local SMB. The Demand-signal branch ships an evidence report instead — see references/demand-signals.md.)
Default to a markdown table in chat. Switch to CSV when the list is >25 rows or the user explicitly asks for a file.
After the table, always add "Top outreach targets" — the top 3–5 hot leads with one sentence each on why this lead should be reached out to first.
Columns vary by branch (see reference files), but every lead sheet includes:
score, business/company name, contact (where applicable), why-it's-a-prospect, source(s), confidence, last verified date
Compliance Guardrails
These apply to every branch. Read first, every engagement.
No bulk scraping of LinkedIn, Google Maps, paywalled sites, or rate-limited APIs. Browser is an assisted research tool, not a scraper.
No CAPTCHA, login wall, or bot protection bypass. If a site requires it, work with what's publicly visible.
Public business contact channels only. Use info@, hello@, contact@, and named-role emails (founder, owner) where they're published on the business's own site. Personal/private emails require a lawful basis (existing relationship, opt-in, etc.).
GDPR / CAN-SPAM / CASL aware. Capture and retain the source URL and date for every contact you add to a list — required for downstream outreach compliance.
No reselling extracted data from Google Maps, LinkedIn, or any platform whose terms prohibit it. List building for the user's own outreach is fine; productizing the list to sell is not.
Rate limit yourself. Even on public sources, space requests. Don't fingerprint as a bot.
No breached, leaked, or unprovenanced data. Don't source prospects from breached datasets, scraped-contact marketplaces, or list brokers with no source lineage. Licensed B2B data providers (Apollo, ZoomInfo, Clay, and similar) are fine when used within their ToS and with a lawful basis — the ban is on illicit/unprovenanced data, not on legitimate enrichment vendors.
Never target or infer sensitive traits. Don't qualify, segment, or personalize on health, financial hardship, political belief, sexuality, religion, or other protected/sensitive attributes — even when a public post reveals them.
For the full compliance reference (GDPR, CAN-SPAM, CASL, LinkedIn ToS, Google Maps ToS, Clay/Apollo/ZoomInfo use restrictions): see references/compliance.md.
Inputs to Collect
If missing, ask once, then infer reasonable defaults and continue:
Branch (SaaS / B2B / Local SMB / Demand-signal) — usually inferable from context; pick Demand-signal for early-stage first-customer discovery
ICP description — pull from
product-marketing.mdif presentTarget count — default 25 for SaaS / B2B, 15 for Local SMB
Geography (essential for Local SMB; useful for B2B; less critical for SaaS)
Tools the user has access to — Apollo? Clay? ZoomInfo? Hunter? Truelist? Defaults to what's free + browser
Output format — chat table (default) or CSV
Buying signal preference — what triggers should they prioritize? (funding rounds, hiring, recent move, etc.)
Enrichment Workflows
For multi-provider lookups, cache reuse, and per-credit budgets, load the enrichment playbook. Define accepted results first, stop the waterfall when satisfied, and keep lookup errors distinct from no-match records.
Tool Selection Quick Picks
Full breakdown in references/data-sources.md. Quick picks:
| If the user has access to... | Use it for |
|---|---|
| Apollo | B2B / SaaS firmographic + contact discovery |
| Clay | Multi-source enrichment, waterfall lookups, custom scoring |
| FullEnrich or LeadMagic | Waterfall email and phone enrichment through one API |
| TheirStack | Hiring signals and tech stacks from job posts |
| ZoomInfo | Enterprise B2B contact + intent data |
| Hunter or Snov | Email pattern guessing and verification |
| Truelist | Email deliverability validation (before adding to outreach list) |
| LinkedIn Sales Navigator | Decision-maker mapping (manual, no scraping) |
| BuiltWith / Wappalyzer | Tech stack qualification (SaaS branch) |
| Crunchbase | Funding signals (SaaS branch) |
| GitHub | Stargazers / forks of competitor or adjacent repos (dev-tool SaaS branch) |
| Google Maps + browser | Local SMB discovery |
| Firecrawl / Browserbase | Programmatic extraction from individual prospect websites — never from platforms |
If the user has no enrichment tools: lean on browser-assisted research with public sources — company website, About page, LinkedIn company page, news mentions. Slower but works.
Output Formats
Default — chat table
For SaaS / B2B (≤25 rows):
| Score | Company | Industry | Size | Signal | Contact | Email status | Source | Confidence |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |For Local SMB (≤15 rows) — port from the local-prospector reference:
| Score | Business | Category | Area | Website status | Website/Social | Phone | Why it's a prospect | Confidence |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |CSV — when >25 rows or user requests a file
SaaS / B2B columns:
score,company,domain,industry,size_band,country,signal,contact_name,contact_title,contact_email,email_status,linkedin,source_urls,why_prospect,confidence,verified_date,notesLocal SMB columns:
score,business,category,area,distance_km,website_status,website_url,social_urls,phone,email,source_urls,why_prospect,confidence,verified_date,notesAlways include after the table
Top outreach targets: top 3–5 hot leads with one-sentence outreach rationale each
Search parameters: branch, ICP, location/radius, target count, date generated
Open questions: anything you couldn't verify and the user should look at
Quality Checks (before finalizing)
[ ] Remove duplicates (by domain for SaaS/B2B, by business + address for Local SMB)
[ ] Every "Hot" lead has a verified contact + at least one source URL
[ ] No lead has an email that failed Truelist (or your validator) verification — move to a separate "invalid" bucket and flag for the user
[ ] No lead labeled "Hot" lacks a clear buying signal
[ ] Confidence levels honest — "High" requires 2 independent sources, not just two of your own searches
[ ] No leads sourced from prohibited scraping (LinkedIn at scale, Google Maps bulk extract, etc.)
[ ] Source URL + date captured for every contact (GDPR / CAN-SPAM lineage)
[ ] Final count matches user's request, or you've explained why it's smaller (quality bar)
Common Mistakes
Starting discovery without an ICP. Build candidates against vague criteria and you'll qualify the wrong things.
Treating data sources as authoritative without cross-checks. Apollo and ZoomInfo are out of date often; verify before scoring as "Hot."
Adding contacts without email verification. Cold email reputation tanks fast with bounces — always validate.
Bulk scraping LinkedIn or Google Maps. Real risk: account suspension + ToS violation. Browser as an assisted tool only.
Mixing branches. Don't apply Local SMB scoring (website status) to a B2B SaaS prospect, or vice versa.
"Hot" labels without buying signals. ICP fit alone is not enough — the signal is what makes the timing right.
No source URLs. Every claim should be traceable to a public source. Future outreach depends on this lineage.
Ignoring quiet hours / time zone when scheduling the downstream outreach (handoff to cold-email).
Forgetting to retain consent / lineage records. Required for GDPR DSARs and CAN-SPAM audits.
Task-Specific Questions
Which branch — SaaS, B2B, Local SMB, or Demand-signal (early-stage, finding your first customers)?
What's your ICP? (Or: should I pull from your product-marketing context?)
How many qualified leads do you want?
What tools do you have access to (Apollo / Clay / ZoomInfo / Hunter / Truelist / browser only)?
What's the triggering buying signal you care most about?
Geography or radius (Local SMB / B2B)?
Chat table or CSV?
Tool Integrations
For implementation, see the tools registry. Key prospecting tools:
| Tool | Best For | MCP | Guide |
|---|---|---|---|
| Apollo | B2B / SaaS firmographic + contact discovery | ✓ | apollo.md |
| Clay | Multi-source enrichment + waterfall | ✓ | clay.md |
| FullEnrich | Waterfall email + phone enrichment | ✓ | fullenrich.md |
| LeadMagic | Email, phone, and job-change enrichment | ✓ | leadmagic.md |
| TheirStack | Hiring signals and tech stacks from job posts | ✓ | theirstack.md |
| Apify | Structured data from public directories (never LinkedIn) | ✓ | apify.md |
| ZoomInfo | Enterprise B2B contact + intent | ✓ | zoominfo.md |
| Hunter | Email pattern + verification | ✓ | hunter.md |
| Snov | Email finder + verifier | - | snov.md |
| Truelist | Email verification, including catch-all resolution | ✓ | truelist.md |
| Outreach | Sales engagement (post-list) | ✓ | outreach.md |
| RB2B | Visitor identification (warm intent) | - | rb2b.md |
| Ploy ◆ | Visitor identification on Ploy-hosted sites (one option alongside RB2B and other visitor-ID tools) | - | ploy.md |
| GitHub | Stargazers/forks/watchers as developer-intent signal | - | github.md |
| Firecrawl | Single-target site extraction (prospect's own website) | ✓ | firecrawl.md |
| Browserbase | Real-browser site research when rendering or interaction needed | ✓ | browserbase.md |
Related Skills
cold-email: For writing outbound sequences against the qualified list (the natural next step after prospecting)
customer-research: For understanding why current customers buy — informs the ICP definition
competitor-profiling: For researching competitors. Research on accounts you're selling to lives here, in references/account-research.md
revops: For lead routing, lifecycle, and CRM handoff after prospecting
sales-enablement: For battle cards and one-pagers used in the outreach
directory-submissions: For inbound discovery surfaces (the prospects might find you back)
product-marketing: For the ICP definition that anchors every prospecting engagement
Files
- ATTRIBUTION.mdAdded by AutoGineer883 B
- LICENSELicence file added by AutoGineer1.0 KiB
- SKILL.md19.9 KiB
- evals/evals.json17.9 KiB
- references/account-research.md3.7 KiB
- references/b2b-prospecting.md4.9 KiB
- references/compliance.md10.8 KiB
- references/data-sources.md13.1 KiB
- references/demand-signals.md9.9 KiB
- references/enrichment-playbook.md5.2 KiB
- references/local-prospecting.md8.0 KiB
- references/saas-prospecting.md5.9 KiB
- references/signal-plays.md13.6 KiB
- references/sourcing-and-enrichment.md6.6 KiB
references/compliance.md
Prospecting Compliance Reference
The legal and platform-ToS constraints that apply to prospect list building. Read first, every engagement.
Operational guidance, not legal advice. For high-volume programs or programs touching EU/UK residents, run your setup past a privacy attorney.
United States — CAN-SPAM (downstream)
CAN-SPAM regulates the cold email send, not the list build. But the list build matters because:
You must be able to identify the source of every email address you contact (required if challenged)
The "from" line and email content rules apply at send time — but you can't lie about how you got the contact
Opt-out requests must be honored within 10 business days and tracked
Every commercial email needs a working opt-out and the sender's valid physical postal address, so plan both before the first send
For prospecting specifically: capture and retain the source URL + date for every contact you add to a list. CAN-SPAM doesn't require it explicitly, but defending your sender practices does.
EU / UK — GDPR
The strictest applicable framework. Triggers when:
Your prospect resides in EU/UK
You're processing personal data (any identifiable info, including business emails tied to a named person)
Lawful bases for cold B2B outreach
You have three credible options:
Legitimate interest (most common for B2B). Requires:
The contact is in a business role likely to be interested in your offer
The data was collected from a public, business-context source
You provide a clear opt-out
You can articulate the legitimate interest test in writing
Consent — typically not feasible for cold outreach (you don't have consent before first contact)
Existing customer relationship — only applies to current customers, not prospects
What you must do
Capture source + date + lawful basis for every contact
Honor data subject access requests (DSARs) — you must be able to disclose, correct, or delete on request
Include a privacy notice / opt-out in the first outreach
Don't store personal data longer than necessary for the legitimate interest
EU specifics
Commercial interest counts. The CJEU's KNLTB ruling (October 2024) confirmed that a purely commercial interest can be a legitimate interest. You still need the balancing test in writing (a legitimate interests assessment).
Tell people where you got their data. When the data didn't come from the person directly (Article 14), say so within a month, and at the latest in the first message. One line works: "I found your email on [source]; reply 'remove' and I'll delete it."
Germany is different. Germany's unfair competition law (UWG §7) requires prior consent for advertising email, B2B included, and competitors enforce it through lawsuits. Exclude German contacts from cold email; use LinkedIn or phone (B2B calls need presumed consent, meaning a concrete reason to believe they'd welcome the call).
National rules sit on top of GDPR. Several countries apply stricter ePrivacy rules to email. When a campaign targets one EU country heavily, check that country's rules.
What disqualifies a list
Bulk-scraped LinkedIn data — explicit ToS violation + GDPR risk
Email addresses purchased from a list broker without source provenance
"Anyone @ this domain" guessed emails sent without verification (multiplies risk + bounces)
UK — PECR
PECR sets the email rules on top of UK GDPR:
Corporate subscribers (limited companies, LLPs, public bodies) can be cold-emailed at their work address without consent, as long as you identify yourself and offer an opt-out.
Sole traders and partnerships are treated like individuals and need consent. Many small agencies and consultancies fall in this group, so check the entity type before sending.
Fines rose sharply. The Data (Use and Access) Act 2025 raised the PECR maximum from £500,000 to £17.5 million or 4% of global turnover, and wrote direct marketing into UK GDPR as a recognised legitimate interest.
Australia — Spam Act
Australia is consent-based. Inferred consent can come from a conspicuously published business address with no "no unsolicited messages" notice, where the message relates to the person's role. Address-harvesting software is prohibited outright. Every message needs sender identification and a working unsubscribe.
Canada — CASL
Stricter than CAN-SPAM. Cold B2B outreach requires:
Express consent (explicit opt-in) — typically not present for cold prospecting
OR implied consent — existing business relationship within 24 months, OR business address publicly published on the company's own site for the purpose of receiving such communications
Practical implication for Canadian prospects: relying on the publicly-published-address exception is the most defensible cold prospecting basis in Canada. You must include sender identification, mailing address, and an unsubscribe mechanism in every message.
Platform Terms of Service
Sales Navigator as a research tool: fine. Use it to define account and persona filters, then pull contacts from a licensed database. Sales Navigator has no native export, caps searches at 2,500 results, and syncs to a CRM only on Advanced plans.
Scraping LinkedIn at any scale: explicit ToS violation. Banned accounts are permanent. Don't.
LinkedIn enforces against vendors as well as users. It sued Proxycurl (which shut down in July 2025 under a permanent injunction) and ProAPIs (October 2025) over fake-account scraping, and removed company pages for Apollo, Seamless, and HeyReach. Any data or automation vendor that depends on LinkedIn can disappear overnight; keep an alternative.
Logged-out vs logged-in. Courts have treated scraping public, logged-out pages differently from scraping behind a login or with fake accounts, which breaches the User Agreement. Under GDPR, "publicly visible" still doesn't mean free to use: France's regulator fined Kaspr €240,000 (December 2024) for collecting contact details from LinkedIn that users had chosen to hide.
Apollo, Clay, and ZoomInfo claim LinkedIn-overlap data through various legitimate channels — verify their data sources before assuming compliance
Messages, InMail, and connection requests are still processing of personal data, so GDPR, PECR, and similar laws apply exactly as they do to email: lawful basis, an opt-out on request, and source records. LinkedIn's own rules apply on top, and third-party automation tools violate its User Agreement.
Google Maps
ToS prohibits bulk extraction or productizing Maps data
Browser-assisted research as a discovery aid: acceptable
Place IDs are exempt from Google's caching limits, so storing them to re-look up a business is fine. Other Maps content (reviews, ratings, photos, and bulk-copied listing details) can't be cached beyond the terms or rebuilt into your own database
The Places API is the compliant way to pull business data programmatically, within its terms
Use Maps to find local businesses, then cross-source from the business's own site for the data you retain
Apollo / ZoomInfo / other licensed data providers
All have their own ToS limiting reselling, downstream sharing, and use cases
Read your contract — typically you can use the data for your own outreach but not productize it
Don't share extracts publicly (e.g., on a leaderboard, in a public report)
Crunchbase
Free tier is read-only for personal use
Paid tier permits broader use within contractual scope
API access requires paid Pro+ tier
Phone and SMS (US)
Do Not Call. Scrub numbers against the National DNC Registry and your internal DNC list before calling. B2B calls to business lines are lower risk, but mobile numbers enriched from data providers are often personal cell phones, which the rules protect.
AI voice counts as an artificial voice. The FCC's February 2024 ruling puts AI-generated voices under the TCPA's artificial or prerecorded voice rules. AI-voiced calls to cell phones need prior express consent, and written consent for marketing. Damages run $500–$1,500 per call. Use AI voice only for inbound calls and requested callbacks.
Opt-outs by any reasonable means. Since April 2025, a consumer can revoke consent by any reasonable means (a reply of "stop," a spoken request), and you have 10 business days to honor it.
Cold SMS to US mobiles needs consent plus 10DLC registration. Treat SMS as a channel for people who've already engaged.
Anti-Patterns (Don't Do These)
Bulk-scraping LinkedIn / Google Maps / Yelp. Browser-assisted research is OK; automated scrapers pointed at these platforms are not. Firecrawl and Browserbase are fine for an individual prospect's own website (the URL you found through manual discovery) — not for the platforms hosting prospects.
Buying lists from random vendors without source provenance. You inherit their legal exposure.
Guessing emails and sending unverified. Bounce rates over 2% destroy sender reputation; legally, you can't claim a "legitimate interest" basis for an email you fabricated.
Harvesting personal email addresses (Gmail, personal Outlook, etc.) from public profiles. Personal addresses raise GDPR risk significantly.
Storing data you don't need. Minimize retention. Don't keep prospect lists forever — GDPR right to deletion applies.
Skipping the lawful basis documentation. If challenged, you need to show your work. Capture source URL + collection date for every contact.
Reselling prospect lists. You may not have the right to share them downstream. Read your data provider contracts.
CAPTCHA bypass / login wall bypass. Even if technically possible, this signals bot behavior and violates virtually every ToS.
Quick Audit Checklist
Before shipping a list to the user (or downstream to cold-email):
[ ] Every contact has a source URL + collection date
[ ] No contacts sourced from scraped LinkedIn data
[ ] No bulk Maps content (reviews, ratings, listing copies) retained beyond Google's terms
[ ] Country gating applied: Germany excluded from cold email, UK sole traders and partnerships excluded without consent, CASL and Spam Act requirements met for Canada and Australia
[ ] Phone numbers scrubbed against DNC; no AI-voice calls to mobiles without consent
[ ] Lawful basis documented (legitimate interest test for B2B, or relevant alternative)
[ ] Email addresses validated (deliverability check before outreach)
[ ] Personal addresses (Gmail, etc.) flagged or excluded
[ ] Source provider contracts permit the intended use case
[ ] Retention plan documented (when to delete)
[ ] First outreach will include an opt-out, a postal address, and (for EU/UK) where the data came from (downstream concern for cold-email skill, but mention it now)
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Corey Haines
- Publisher
- Corey Haines (Community)
- Source
- coreyhaines31/marketingskills · skills/prospecting · commit 96798cf
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Corey Haines or Corey Haines.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download prospecting.zip