Generated banner for Prospecting
Generated logo for Prospecting

Prospecting

Corey HainesCommunityCreated by Corey Haines

  • Skill
  • Workflow
  • Business and productivity
  • MIT
  • No issues found

From the author

When the user wants to find, qualify, and build a list of prospects to reach out to, across B2B SaaS, general B2B, or local small businesses. Also use when the user mentions "prospecting," "build a prospect list," "find leads," "lead list," "outbound list," "target account list," "ICP-fit accounts," "find local businesses," "find my first customers," "design partners," "signal-based outbound," "gap plays," "buying signals," "intent data," "job change alerts," "waterfall enrichment," "Clay table," "lookalike accounts," "catch-all emails," "account tiering," or "research this account before I reach out." Always verify emails before they reach a sequence, and never scrape LinkedIn. Define audiences in Sales Navigator and pull contacts from licensed data. Covers list building, signals, enrichment, verification, and account research. For the outreach itself (copy, sending setup, LinkedIn, cadences, replies), see cold-email. For researching competitors, see competitor-profiling.
— the description by Corey Haines

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a systematic approach to building lead lists by defining an Ideal Customer Profile (ICP) and applying branch-specific discovery methods. It covers four distinct motions: B2B SaaS, general B2B, local SMBs, and early-stage demand-signal discovery. The process emphasizes data verification, compliance with communication regulations, and the use of licensed data sources to ensure lead quality. It guides users through defining ICPs, sourcing candidates, qualifying leads against specific signals, and prioritizing accounts for outreach.

What it does

  • Defines ICPs based on firmographic, technographic, and behavioral signals.
  • Builds candidate lists using licensed data sources and browser-assisted research.
  • Verifies email deliverability to maintain outreach reputation.
  • Scores and tiers prospects based on buying signals and ICP fit.
  • Generates lead sheets in markdown tables or CSV format.
  • Ensures compliance with GDPR, CAN-SPAM, and platform terms of service.

When to use it

  • When you need to build a targeted list of prospects for outbound outreach.
  • When you need to identify early-stage customers or design partners via public signals.
  • When you need to qualify leads based on specific trigger events or buying signals.
  • When you need to research accounts to create personalized outreach briefs.

Advantages

  • Provides a consistent, repeatable framework for lead generation.
  • Reduces bounce rates through mandatory email verification.
  • Maintains compliance by tracking source lineage for every contact.
  • Prevents account suspension by prohibiting bulk scraping of platforms.

Usage examples

“Build a list of 25 B2B SaaS companies that recently raised a Series A and are hiring for growth roles.”
The agent will define the ICP, source companies using tools like Apollo or Crunchbase, verify contact emails, and output a scored table of leads.
“Find 15 local dental clinics in Austin, Texas, that have an active website.”
The agent will use browser-assisted research to identify clinics, verify their website status, and provide a list with contact information and confidence scores.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/coreyhaines31/prospecting/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip prospecting.zip -d .agents/skills

Documentation by Corey Haines

Prospecting

You are an expert at building qualified prospect lists across four motions: B2B SaaS, general B2B, local small businesses, and early-stage demand-signal discovery (finding your first customers from public pain signals). Your goal is to turn an ICP definition into a verified, scored, ready-to-outreach lead sheet — using the right data sources, qualification signals, and compliance posture for each motion.

Before Starting

Check for product marketing context first: If .agents/product-marketing.md exists (or .claude/product-marketing.md, or the legacy product-marketing-context.md filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

Pick the Branch

Prospecting motions differ enough that the workflow forks at intake. Pick one branch based on who the user is selling to:

BranchSell toWhat "qualified" looks likePrimary sources
SaaSOther SaaS companies / digital businessesICP fit + tech stack match + growth signals (funding, hiring, product velocity)LinkedIn, BuiltWith, Crunchbase, Apollo, Clay, ProductHunt
B2BNon-SaaS B2B (services, manufacturers, enterprises, mid-market)Industry + size + geographic fit + buying signals (trigger events, vendor changes)Apollo, ZoomInfo, Clay, LinkedIn Sales Nav, industry directories
Local SMBLocal small businesses (shops, gyms, restaurants, clinics, salons, services)Active business + website status + proximity + decision-maker accessGoogle Maps, Yelp, local directories, Facebook, business websites
Demand-signalEarly-stage: your first customers, design partners, or beta usersEvidence of the exact pain/demand/timing signal — a cited public source, not just firmographic fitForums, communities, reviews, GitHub issues, job posts, launch announcements (via last30days, social-fetch, scraping)

If the user describes a hybrid motion (e.g., "SMBs that are also SaaS"), pick the dominant branch and pull in qualification signals from the other. If the user is early-stage and needs their first customers or design partners — evidence of demand over list coverage — use the Demand-signal branch.

For the branch-specific deep dives:


Shared Framework (all branches)

Every prospecting engagement follows the same five phases. Tools and qualification signals change per branch; the phases don't.

Phase 1 — Define the ICP

Pull from product-marketing.md if available. Otherwise, gather:

  1. Firmographic fit — industry, company size, revenue band, geography, business model

  2. Technographic fit (SaaS branch) — what tools they already use, what they're missing

  3. Buying signal — why now? (trigger event, funding, hiring, new initiative, dissatisfaction with current vendor, recent move/expansion)

  4. Decision-maker profile — role, seniority, what they care about

  5. Disqualifiers — what makes a prospect a clear "skip"

Output the ICP as a one-paragraph statement plus a checklist of pass/fail criteria. Don't move to discovery without this.

Phase 2 — Build the candidate list (discovery)

Source 2–3× more candidates than the user wants in the final list — qualification will cull aggressively.

  • SaaS / B2B: combine 2–3 sources for cross-verification. Apollo or ZoomInfo for firmographics; Clay or a waterfall aggregator (FullEnrich, LeadMagic) for enrichment; LinkedIn Sales Nav for decision-maker mapping.

  • Local SMB: browser-assisted research starting with Google Maps for the target category in the target area; cross-check with Yelp, the business website, social pages, and public directories.

If the user's list quality bar is high, smaller is better. 25 verified leads beats 250 mostly-junk ones.

For LinkedIn audiences, define the filters in Sales Navigator and pull the contacts from a licensed database. For legitimate non-LinkedIn sources, AI list builders, lookalikes, and the enrichment waterfall, see references/sourcing-and-enrichment.md. To find accounts by what just happened to them (hiring, job changes, product usage, funding), gap plays (a signal plus a gap you can verify from outside, such as ads running with no visible tracking), or warm paths through your own network, see references/signal-plays.md.

Phase 3 — Qualify each candidate

Score every candidate against the ICP checklist. Add evidence (a source URL or two) for each qualification — never assert without backing.

Confidence levels (used across all branches):

  • High: confirmed by at least two independent sources or official business page

  • Medium: one credible source plus consistent search evidence

  • Low: incomplete or ambiguous evidence — flag what remains uncertain

For email contacts (B2B / SaaS branches), always verify deliverability before adding to the final list, and again within 7 days of sending if the list sat. Catch-all domains need a set policy. See references/sourcing-and-enrichment.md for the verification actions, catch-all handling, and the suppression list. Don't ship leads with invalid or risky emails.

Phase 4 — Score and prioritize

Apply this rubric for the SaaS, B2B, and Local SMB branches. The Demand-signal branch scores differently — 0–100 demand-fit, not Hot/Warm/Cold — see references/demand-signals.md.

ScoreDefinition
HotStrong ICP fit + clear buying signal + decision-maker accessible + verified contact
WarmICP fit + softer or older signal + contact verifiable
ColdLoose ICP fit OR no clear signal OR contact unverified
SkipDisqualifier hit (out of ICP, closed business, duplicate, irrelevant, low confidence)

Branch-specific signals refine the scoring — see each reference file. Default ratio target: ~20% Hot, ~30% Warm, rest Cold/Skip.

Then assign an account tier, which sets how much research and how many channels each account gets: Tier 1 (1:1, the top 25–50), Tier 2 (1:few, segments of 20–200 sharing one pain), Tier 3 (1:many). Tier 1 accounts get a sourced research brief before any outreach. See references/signal-plays.md for tiers and references/account-research.md for the brief and the rules for agent research.

Phase 5 — Output the lead sheet

(SaaS / B2B / Local SMB. The Demand-signal branch ships an evidence report instead — see references/demand-signals.md.)

Default to a markdown table in chat. Switch to CSV when the list is >25 rows or the user explicitly asks for a file.

After the table, always add "Top outreach targets" — the top 3–5 hot leads with one sentence each on why this lead should be reached out to first.

Columns vary by branch (see reference files), but every lead sheet includes:

  • score, business/company name, contact (where applicable), why-it's-a-prospect, source(s), confidence, last verified date


Compliance Guardrails

These apply to every branch. Read first, every engagement.

  1. No bulk scraping of LinkedIn, Google Maps, paywalled sites, or rate-limited APIs. Browser is an assisted research tool, not a scraper.

  2. No CAPTCHA, login wall, or bot protection bypass. If a site requires it, work with what's publicly visible.

  3. Public business contact channels only. Use info@, hello@, contact@, and named-role emails (founder, owner) where they're published on the business's own site. Personal/private emails require a lawful basis (existing relationship, opt-in, etc.).

  4. GDPR / CAN-SPAM / CASL aware. Capture and retain the source URL and date for every contact you add to a list — required for downstream outreach compliance.

  5. No reselling extracted data from Google Maps, LinkedIn, or any platform whose terms prohibit it. List building for the user's own outreach is fine; productizing the list to sell is not.

  6. Rate limit yourself. Even on public sources, space requests. Don't fingerprint as a bot.

  7. No breached, leaked, or unprovenanced data. Don't source prospects from breached datasets, scraped-contact marketplaces, or list brokers with no source lineage. Licensed B2B data providers (Apollo, ZoomInfo, Clay, and similar) are fine when used within their ToS and with a lawful basis — the ban is on illicit/unprovenanced data, not on legitimate enrichment vendors.

  8. Never target or infer sensitive traits. Don't qualify, segment, or personalize on health, financial hardship, political belief, sexuality, religion, or other protected/sensitive attributes — even when a public post reveals them.

For the full compliance reference (GDPR, CAN-SPAM, CASL, LinkedIn ToS, Google Maps ToS, Clay/Apollo/ZoomInfo use restrictions): see references/compliance.md.


Inputs to Collect

If missing, ask once, then infer reasonable defaults and continue:

  • Branch (SaaS / B2B / Local SMB / Demand-signal) — usually inferable from context; pick Demand-signal for early-stage first-customer discovery

  • ICP description — pull from product-marketing.md if present

  • Target count — default 25 for SaaS / B2B, 15 for Local SMB

  • Geography (essential for Local SMB; useful for B2B; less critical for SaaS)

  • Tools the user has access to — Apollo? Clay? ZoomInfo? Hunter? Truelist? Defaults to what's free + browser

  • Output format — chat table (default) or CSV

  • Buying signal preference — what triggers should they prioritize? (funding rounds, hiring, recent move, etc.)


Enrichment Workflows

For multi-provider lookups, cache reuse, and per-credit budgets, load the enrichment playbook. Define accepted results first, stop the waterfall when satisfied, and keep lookup errors distinct from no-match records.


Tool Selection Quick Picks

Full breakdown in references/data-sources.md. Quick picks:

If the user has access to...Use it for
ApolloB2B / SaaS firmographic + contact discovery
ClayMulti-source enrichment, waterfall lookups, custom scoring
FullEnrich or LeadMagicWaterfall email and phone enrichment through one API
TheirStackHiring signals and tech stacks from job posts
ZoomInfoEnterprise B2B contact + intent data
Hunter or SnovEmail pattern guessing and verification
TruelistEmail deliverability validation (before adding to outreach list)
LinkedIn Sales NavigatorDecision-maker mapping (manual, no scraping)
BuiltWith / WappalyzerTech stack qualification (SaaS branch)
CrunchbaseFunding signals (SaaS branch)
GitHubStargazers / forks of competitor or adjacent repos (dev-tool SaaS branch)
Google Maps + browserLocal SMB discovery
Firecrawl / BrowserbaseProgrammatic extraction from individual prospect websites — never from platforms

If the user has no enrichment tools: lean on browser-assisted research with public sources — company website, About page, LinkedIn company page, news mentions. Slower but works.


Output Formats

Default — chat table

For SaaS / B2B (≤25 rows):

| Score | Company | Industry | Size | Signal | Contact | Email status | Source | Confidence |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |

For Local SMB (≤15 rows) — port from the local-prospector reference:

| Score | Business | Category | Area | Website status | Website/Social | Phone | Why it's a prospect | Confidence |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
CSV — when >25 rows or user requests a file

SaaS / B2B columns:

score,company,domain,industry,size_band,country,signal,contact_name,contact_title,contact_email,email_status,linkedin,source_urls,why_prospect,confidence,verified_date,notes

Local SMB columns:

score,business,category,area,distance_km,website_status,website_url,social_urls,phone,email,source_urls,why_prospect,confidence,verified_date,notes
Always include after the table
  • Top outreach targets: top 3–5 hot leads with one-sentence outreach rationale each

  • Search parameters: branch, ICP, location/radius, target count, date generated

  • Open questions: anything you couldn't verify and the user should look at


Quality Checks (before finalizing)

  • [ ] Remove duplicates (by domain for SaaS/B2B, by business + address for Local SMB)

  • [ ] Every "Hot" lead has a verified contact + at least one source URL

  • [ ] No lead has an email that failed Truelist (or your validator) verification — move to a separate "invalid" bucket and flag for the user

  • [ ] No lead labeled "Hot" lacks a clear buying signal

  • [ ] Confidence levels honest — "High" requires 2 independent sources, not just two of your own searches

  • [ ] No leads sourced from prohibited scraping (LinkedIn at scale, Google Maps bulk extract, etc.)

  • [ ] Source URL + date captured for every contact (GDPR / CAN-SPAM lineage)

  • [ ] Final count matches user's request, or you've explained why it's smaller (quality bar)


Common Mistakes

  1. Starting discovery without an ICP. Build candidates against vague criteria and you'll qualify the wrong things.

  2. Treating data sources as authoritative without cross-checks. Apollo and ZoomInfo are out of date often; verify before scoring as "Hot."

  3. Adding contacts without email verification. Cold email reputation tanks fast with bounces — always validate.

  4. Bulk scraping LinkedIn or Google Maps. Real risk: account suspension + ToS violation. Browser as an assisted tool only.

  5. Mixing branches. Don't apply Local SMB scoring (website status) to a B2B SaaS prospect, or vice versa.

  6. "Hot" labels without buying signals. ICP fit alone is not enough — the signal is what makes the timing right.

  7. No source URLs. Every claim should be traceable to a public source. Future outreach depends on this lineage.

  8. Ignoring quiet hours / time zone when scheduling the downstream outreach (handoff to cold-email).

  9. Forgetting to retain consent / lineage records. Required for GDPR DSARs and CAN-SPAM audits.


Task-Specific Questions

  1. Which branch — SaaS, B2B, Local SMB, or Demand-signal (early-stage, finding your first customers)?

  2. What's your ICP? (Or: should I pull from your product-marketing context?)

  3. How many qualified leads do you want?

  4. What tools do you have access to (Apollo / Clay / ZoomInfo / Hunter / Truelist / browser only)?

  5. What's the triggering buying signal you care most about?

  6. Geography or radius (Local SMB / B2B)?

  7. Chat table or CSV?


Tool Integrations

For implementation, see the tools registry. Key prospecting tools:

ToolBest ForMCPGuide
ApolloB2B / SaaS firmographic + contact discovery✓apollo.md
ClayMulti-source enrichment + waterfall✓clay.md
FullEnrichWaterfall email + phone enrichment✓fullenrich.md
LeadMagicEmail, phone, and job-change enrichment✓leadmagic.md
TheirStackHiring signals and tech stacks from job posts✓theirstack.md
ApifyStructured data from public directories (never LinkedIn)✓apify.md
ZoomInfoEnterprise B2B contact + intent✓zoominfo.md
HunterEmail pattern + verification✓hunter.md
SnovEmail finder + verifier-snov.md
TruelistEmail verification, including catch-all resolution✓truelist.md
OutreachSales engagement (post-list)✓outreach.md
RB2BVisitor identification (warm intent)-rb2b.md
Ploy ◆Visitor identification on Ploy-hosted sites (one option alongside RB2B and other visitor-ID tools)-ploy.md
GitHubStargazers/forks/watchers as developer-intent signal-github.md
FirecrawlSingle-target site extraction (prospect's own website)✓firecrawl.md
BrowserbaseReal-browser site research when rendering or interaction needed✓browserbase.md

  • cold-email: For writing outbound sequences against the qualified list (the natural next step after prospecting)

  • customer-research: For understanding why current customers buy — informs the ICP definition

  • competitor-profiling: For researching competitors. Research on accounts you're selling to lives here, in references/account-research.md

  • revops: For lead routing, lifecycle, and CRM handoff after prospecting

  • sales-enablement: For battle cards and one-pagers used in the outreach

  • directory-submissions: For inbound discovery surfaces (the prospects might find you back)

  • product-marketing: For the ICP definition that anchors every prospecting engagement

Files

references/compliance.md

Prospecting Compliance Reference

The legal and platform-ToS constraints that apply to prospect list building. Read first, every engagement.

Operational guidance, not legal advice. For high-volume programs or programs touching EU/UK residents, run your setup past a privacy attorney.


United States — CAN-SPAM (downstream)

CAN-SPAM regulates the cold email send, not the list build. But the list build matters because:

  • You must be able to identify the source of every email address you contact (required if challenged)

  • The "from" line and email content rules apply at send time — but you can't lie about how you got the contact

  • Opt-out requests must be honored within 10 business days and tracked

  • Every commercial email needs a working opt-out and the sender's valid physical postal address, so plan both before the first send

For prospecting specifically: capture and retain the source URL + date for every contact you add to a list. CAN-SPAM doesn't require it explicitly, but defending your sender practices does.


EU / UK — GDPR

The strictest applicable framework. Triggers when:

  • Your prospect resides in EU/UK

  • You're processing personal data (any identifiable info, including business emails tied to a named person)

Lawful bases for cold B2B outreach

You have three credible options:

  1. Legitimate interest (most common for B2B). Requires:

    • The contact is in a business role likely to be interested in your offer

    • The data was collected from a public, business-context source

    • You provide a clear opt-out

    • You can articulate the legitimate interest test in writing

  2. Consent — typically not feasible for cold outreach (you don't have consent before first contact)

  3. Existing customer relationship — only applies to current customers, not prospects

What you must do
  • Capture source + date + lawful basis for every contact

  • Honor data subject access requests (DSARs) — you must be able to disclose, correct, or delete on request

  • Include a privacy notice / opt-out in the first outreach

  • Don't store personal data longer than necessary for the legitimate interest

EU specifics
  • Commercial interest counts. The CJEU's KNLTB ruling (October 2024) confirmed that a purely commercial interest can be a legitimate interest. You still need the balancing test in writing (a legitimate interests assessment).

  • Tell people where you got their data. When the data didn't come from the person directly (Article 14), say so within a month, and at the latest in the first message. One line works: "I found your email on [source]; reply 'remove' and I'll delete it."

  • Germany is different. Germany's unfair competition law (UWG §7) requires prior consent for advertising email, B2B included, and competitors enforce it through lawsuits. Exclude German contacts from cold email; use LinkedIn or phone (B2B calls need presumed consent, meaning a concrete reason to believe they'd welcome the call).

  • National rules sit on top of GDPR. Several countries apply stricter ePrivacy rules to email. When a campaign targets one EU country heavily, check that country's rules.

What disqualifies a list
  • Bulk-scraped LinkedIn data — explicit ToS violation + GDPR risk

  • Email addresses purchased from a list broker without source provenance

  • "Anyone @ this domain" guessed emails sent without verification (multiplies risk + bounces)


UK — PECR

PECR sets the email rules on top of UK GDPR:

  • Corporate subscribers (limited companies, LLPs, public bodies) can be cold-emailed at their work address without consent, as long as you identify yourself and offer an opt-out.

  • Sole traders and partnerships are treated like individuals and need consent. Many small agencies and consultancies fall in this group, so check the entity type before sending.

  • Fines rose sharply. The Data (Use and Access) Act 2025 raised the PECR maximum from £500,000 to £17.5 million or 4% of global turnover, and wrote direct marketing into UK GDPR as a recognised legitimate interest.


Australia — Spam Act

Australia is consent-based. Inferred consent can come from a conspicuously published business address with no "no unsolicited messages" notice, where the message relates to the person's role. Address-harvesting software is prohibited outright. Every message needs sender identification and a working unsubscribe.


Canada — CASL

Stricter than CAN-SPAM. Cold B2B outreach requires:

  • Express consent (explicit opt-in) — typically not present for cold prospecting

  • OR implied consent — existing business relationship within 24 months, OR business address publicly published on the company's own site for the purpose of receiving such communications

Practical implication for Canadian prospects: relying on the publicly-published-address exception is the most defensible cold prospecting basis in Canada. You must include sender identification, mailing address, and an unsubscribe mechanism in every message.


Platform Terms of Service

LinkedIn
  • Sales Navigator as a research tool: fine. Use it to define account and persona filters, then pull contacts from a licensed database. Sales Navigator has no native export, caps searches at 2,500 results, and syncs to a CRM only on Advanced plans.

  • Scraping LinkedIn at any scale: explicit ToS violation. Banned accounts are permanent. Don't.

  • LinkedIn enforces against vendors as well as users. It sued Proxycurl (which shut down in July 2025 under a permanent injunction) and ProAPIs (October 2025) over fake-account scraping, and removed company pages for Apollo, Seamless, and HeyReach. Any data or automation vendor that depends on LinkedIn can disappear overnight; keep an alternative.

  • Logged-out vs logged-in. Courts have treated scraping public, logged-out pages differently from scraping behind a login or with fake accounts, which breaches the User Agreement. Under GDPR, "publicly visible" still doesn't mean free to use: France's regulator fined Kaspr €240,000 (December 2024) for collecting contact details from LinkedIn that users had chosen to hide.

  • Apollo, Clay, and ZoomInfo claim LinkedIn-overlap data through various legitimate channels — verify their data sources before assuming compliance

  • Messages, InMail, and connection requests are still processing of personal data, so GDPR, PECR, and similar laws apply exactly as they do to email: lawful basis, an opt-out on request, and source records. LinkedIn's own rules apply on top, and third-party automation tools violate its User Agreement.

Google Maps
  • ToS prohibits bulk extraction or productizing Maps data

  • Browser-assisted research as a discovery aid: acceptable

  • Place IDs are exempt from Google's caching limits, so storing them to re-look up a business is fine. Other Maps content (reviews, ratings, photos, and bulk-copied listing details) can't be cached beyond the terms or rebuilt into your own database

  • The Places API is the compliant way to pull business data programmatically, within its terms

  • Use Maps to find local businesses, then cross-source from the business's own site for the data you retain

Apollo / ZoomInfo / other licensed data providers
  • All have their own ToS limiting reselling, downstream sharing, and use cases

  • Read your contract — typically you can use the data for your own outreach but not productize it

  • Don't share extracts publicly (e.g., on a leaderboard, in a public report)

Crunchbase
  • Free tier is read-only for personal use

  • Paid tier permits broader use within contractual scope

  • API access requires paid Pro+ tier


Phone and SMS (US)

  • Do Not Call. Scrub numbers against the National DNC Registry and your internal DNC list before calling. B2B calls to business lines are lower risk, but mobile numbers enriched from data providers are often personal cell phones, which the rules protect.

  • AI voice counts as an artificial voice. The FCC's February 2024 ruling puts AI-generated voices under the TCPA's artificial or prerecorded voice rules. AI-voiced calls to cell phones need prior express consent, and written consent for marketing. Damages run $500–$1,500 per call. Use AI voice only for inbound calls and requested callbacks.

  • Opt-outs by any reasonable means. Since April 2025, a consumer can revoke consent by any reasonable means (a reply of "stop," a spoken request), and you have 10 business days to honor it.

  • Cold SMS to US mobiles needs consent plus 10DLC registration. Treat SMS as a channel for people who've already engaged.


Anti-Patterns (Don't Do These)

  1. Bulk-scraping LinkedIn / Google Maps / Yelp. Browser-assisted research is OK; automated scrapers pointed at these platforms are not. Firecrawl and Browserbase are fine for an individual prospect's own website (the URL you found through manual discovery) — not for the platforms hosting prospects.

  2. Buying lists from random vendors without source provenance. You inherit their legal exposure.

  3. Guessing emails and sending unverified. Bounce rates over 2% destroy sender reputation; legally, you can't claim a "legitimate interest" basis for an email you fabricated.

  4. Harvesting personal email addresses (Gmail, personal Outlook, etc.) from public profiles. Personal addresses raise GDPR risk significantly.

  5. Storing data you don't need. Minimize retention. Don't keep prospect lists forever — GDPR right to deletion applies.

  6. Skipping the lawful basis documentation. If challenged, you need to show your work. Capture source URL + collection date for every contact.

  7. Reselling prospect lists. You may not have the right to share them downstream. Read your data provider contracts.

  8. CAPTCHA bypass / login wall bypass. Even if technically possible, this signals bot behavior and violates virtually every ToS.


Quick Audit Checklist

Before shipping a list to the user (or downstream to cold-email):

  • [ ] Every contact has a source URL + collection date

  • [ ] No contacts sourced from scraped LinkedIn data

  • [ ] No bulk Maps content (reviews, ratings, listing copies) retained beyond Google's terms

  • [ ] Country gating applied: Germany excluded from cold email, UK sole traders and partnerships excluded without consent, CASL and Spam Act requirements met for Canada and Australia

  • [ ] Phone numbers scrubbed against DNC; no AI-voice calls to mobiles without consent

  • [ ] Lawful basis documented (legitimate interest test for B2B, or relevant alternative)

  • [ ] Email addresses validated (deliverability check before outreach)

  • [ ] Personal addresses (Gmail, etc.) flagged or excluded

  • [ ] Source provider contracts permit the intended use case

  • [ ] Retention plan documented (when to delete)

  • [ ] First outreach will include an opt-out, a postal address, and (for EU/UK) where the data came from (downstream concern for cold-email skill, but mention it now)

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Corey Haines
Publisher
Corey Haines (Community)
Source
coreyhaines31/marketingskills · skills/prospecting · commit 96798cf
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Corey Haines.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download prospecting.zip