Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Zevenue/headless-gtmnpx agentmods add skills/zevenue/headless-gtm/01-prospeo-discoverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zevenue/headless-gtm/01-prospeo-discover)<a href="https://agentmods.dev/skills/zevenue/headless-gtm/01-prospeo-discover"><img src="https://agentmods.dev/badge/skills/zevenue/headless-gtm/01-prospeo-discover/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zevenue/headless-gtm/01-prospeo-discover"><img src="https://agentmods.dev/badge/skills/zevenue/headless-gtm/01-prospeo-discover.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 41 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Data Exfiltration · line 35 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 42 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 65 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00139 | $0.03554 |
| Opus 5 | $0.00069 | $0.01777 |
| Sonnet 5 | $0.00028 | $0.00711 |
| Haiku 4.5 | $0.00014 | $0.00355 |
Grade A, and why
01-prospeo-discover scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
The curl examples use `$PROSPEO_API_KEY` as the key. **A `.env` file is not How it starts
The opening of the file, as written. The whole thing — 249 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prospeo Discover - B2B Company List Builder
Turn a plain-English ICP into Prospeo filter JSON, run a company search against Prospeo's 30M+ company database (33 filters), present the result, and export to Google Sheets on request.
Your job
- Work out what the user has given you and what's still missing.
- Map their language to exact Prospeo filter values. Resolve anything you're unsure of via the API rather than inventing enum values.
- Cover the mandatory filters, using the smart defaults below for anything they skip.
- Recommend a few high-impact optional filters, then stop.
- Run the search, show the count plus a 25-row preview, and export only when asked.
Credits are real money: each search page costs 1 credit; account and suggestion calls are free. Guard spend, especially on export.
Setup
Auth reads from environment variables. Nothing is hardcoded.
PROSPEO_API_KEY- required for every Prospeo call.- Google Sheets export reads OAuth credentials from
GOOGLE_TOKEN_PATH(default~/.google/token.json). Only needed when exporting.
The curl examples use $PROSPEO_API_KEY as the key. A .env file is not
visible to curl - load it into the shell first, in the same command as the
call, or curl sends an empty X-KEY header and the API returns a confusing
auth error instead of a missing-key one:
set -a; [ -f .env ] && . ./.env; set +a
curl -s -H "X-KEY: $PROSPEO_API_KEY" https://api.prospeo.io/account-information
Check $PROSPEO_API_KEY is non-empty before the first paid call. The Python
scripts under scripts/ read .env themselves and need no such prelude.
API basics
Base URL: https://api.prospeo.io
Auth header: X-KEY: $PROSPEO_API_KEY
Content-Type: application/json
Three endpoints:
GET /account-information- plan and credit balance (free)POST /search-company- the search (1 credit per page)POST /search-suggestions- resolve locations, technologies, industries, and other open-ended values (free)
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 249 lines · 139 tokens per session scan A c403d69a6f96
01-prospeo-discover is a skill published in the GitHub repository Zevenue/headless-gtm (27 stars, last pushed 1mo ago), licensed MIT. It adds 139 tokens to every session and 3,554 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gtm-machine
Validate startup ideas with evidence and test them with real outbound — the full loop from raw idea to booked calls. Use this skill whenever an idea-stage founder wants to validate a startup or product idea, assess AI-platform kill-risk, check if a market is worth entering, build an ICP or personas, source leads from…
deepline-ads-audiences
Use this skill when building, enriching, auditing, or uploading B2B paid ads audiences to Google Customer Match, Meta/Facebook Custom Audiences, or LinkedIn Matched Audiences. Triggers on phrases like '/deepline-ads-audience', '/deepline-ads-audiences', 'upload this audience', 'create custom audiences', 'personal…
deepline-gtm
GTM prospecting, enrichment, outreach, and Deepline Play work/audits. Providers…
deepline-pre-research
Use when the user wants a last30days-style pre-research pass in Deepline: discover the critical public, private, CRM, workflow, social, and web data sources for a research/enrichment job; compare provider coverage; estimate Deepline credit cost; recommend the source plan before building or running the workflow; or…
deepline-analytics
Use this skill when answering business analytics, RevOps, GTM metric, pipeline, revenue, funnel, customer, or warehouse questions with Deepline. Triggers on phrases like 'query Snowflake', 'analyze pipeline', 'total ACV', 'break down by quarter', 'use the semantic layer', 'run a semantic query', or any use of…
niche-signal-discovery
Discover niche first-party signals that differentiate Closed Won vs Closed Lost accounts for ICP analysis. Use when the user provides won/lost customer domain lists and wants differential signals (website content, job listings, tech stack, maturity markers) to build account scoring models and prospecting criteria.…