Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Zevenue/headless-gtmnpx agentmods add skills/zevenue/headless-gtm/01-prospeo-lookalikeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zevenue/headless-gtm/01-prospeo-lookalike)<a href="https://agentmods.dev/skills/zevenue/headless-gtm/01-prospeo-lookalike"><img src="https://agentmods.dev/badge/skills/zevenue/headless-gtm/01-prospeo-lookalike/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zevenue/headless-gtm/01-prospeo-lookalike"><img src="https://agentmods.dev/badge/skills/zevenue/headless-gtm/01-prospeo-lookalike.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 50 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Data Exfiltration · line 44 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 51 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 75 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00134 | $0.03769 |
| Opus 5 | $0.00067 | $0.01885 |
| Sonnet 5 | $0.00027 | $0.00754 |
| Haiku 4.5 | $0.00013 | $0.00377 |
Grade A, and why
01-prospeo-lookalike scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
The curl examples use `$PROSPEO_API_KEY` as the key. **A `.env` file is not How it starts
The opening of the file, as written. The whole thing — 277 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prospeo Lookalike - Seed-Based Company Discovery
Turn seed companies (domains, an ICP description, or "similar to X") into similar companies via
Prospeo's company_lookalike filter (33-filter, 30M+ company database). Two ways to finish:
- Mode 1 - Lookalike list (headline): return the actual similar companies, ranked by similarity tier. The lookalike filter runs alone - no ICP stacking - so you get a full list, not single digits.
- Mode 2 - Seed → ICP handoff: analyze the 25 closest matches for patterns, build an ICP, and hand
it to
01-prospeo-discoverfor a broad firmographic search.
Discovery (skill 01) deliberately treats lookalike as a throwaway pattern-finder and drops it before its real search. This skill is the opposite - here the lookalike matches are a first-class deliverable.
Your job
- Collect the seed(s) - domains, named companies, or an ICP paragraph - and pick the mode.
- Resolve seeds to what the API needs (domain string, company IDs, or
icp_text). - Run the lookalike search, present the ranked matches with the similarity tier.
- Offer the next step: export the list (Mode 1) or build an ICP and route to discovery (Mode 2).
Credits are real money: each search page costs 1 credit; account and suggestion calls are free. Guard spend, especially on export.
Setup
Auth reads from environment variables. Nothing is hardcoded.
PROSPEO_API_KEY- required for every Prospeo call.- Google Sheets export reads OAuth credentials from
GOOGLE_TOKEN_PATH(default~/.google/token.json). Only needed when exporting.
The curl examples use $PROSPEO_API_KEY as the key. A .env file is not
visible to curl - load it into the shell first, in the same command as the
call, or curl sends an empty X-KEY header and the API returns a confusing
auth error instead of a missing-key one:
set -a; [ -f .env ] && . ./.env; set +a
curl -s -H "X-KEY: $PROSPEO_API_KEY" https://api.prospeo.io/account-information
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 3.2 KB
- references/api-curl.md 6.2 KB
- references/enum-refresh.md 3.2 KB
- references/filters-full.md 9.3 KB
- references/lookalike-modes.md 7.5 KB
- references/mapping-examples.md 4.3 KB
- references/plan-filter-map.md 2.6 KB
- references/prospeo-enums.json 14 KB
- scripts/sheets_export.py 24 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 277 lines · 134 tokens per session scan A aa2ef4bc7127
01-prospeo-lookalike is a skill published in the GitHub repository Zevenue/headless-gtm (28 stars, last pushed 1mo ago), licensed MIT. It adds 134 tokens to every session and 3,769 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gtm-machine
Validate startup ideas with evidence and test them with real outbound — the full loop from raw idea to booked calls. Use this skill whenever an idea-stage founder wants to validate a startup or product idea, assess AI-platform kill-risk, check if a market is worth entering, build an ICP or personas, source leads from…
deepline-ads-audiences
Use this skill when building, enriching, auditing, or uploading B2B paid ads audiences to Google Customer Match, Meta/Facebook Custom Audiences, or LinkedIn Matched Audiences. Triggers on phrases like '/deepline-ads-audience', '/deepline-ads-audiences', 'upload this audience', 'create custom audiences', 'personal…
deepline-gtm
GTM prospecting, enrichment, outreach, and Deepline Play work/audits. Providers…
deepline-pre-research
Use when the user wants a last30days-style pre-research pass in Deepline: discover the critical public, private, CRM, workflow, social, and web data sources for a research/enrichment job; compare provider coverage; estimate Deepline credit cost; recommend the source plan before building or running the workflow; or…
deepline-analytics
Use this skill when answering business analytics, RevOps, GTM metric, pipeline, revenue, funnel, customer, or warehouse questions with Deepline. Triggers on phrases like 'query Snowflake', 'analyze pipeline', 'total ACV', 'break down by quarter', 'use the semantic layer', 'run a semantic query', or any use of…
niche-signal-discovery
Discover niche first-party signals that differentiate Closed Won vs Closed Lost accounts for ICP analysis. Use when the user provides won/lost customer domain lists and wants differential signals (website content, job listings, tech stack, maturity markers) to build account scoring models and prospecting criteria.…