Pangolinfo Amazon Scraper: Products + Keywords + Reviews + Categories

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Pangolinfo Amazon-scraping client, but users should notice that it uses Pangolinfo credentials, sends lookup data to a cloud API, can consume account credits, and optionally persists an API key.

This skill appears suitable if you intend to use Pangolinfo for Amazon scraping. Prefer an API key over email/password, avoid caching the key on shared machines, and specify small page or result limits so an agent does not unexpectedly consume many credits.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If you provide the email/password fallback, the agent environment will contain Pangolinfo account login credentials.

Why it was flagged

The skill uses Pangolinfo account credentials or an API key. This is purpose-aligned for the service, but email/password use is more sensitive than an API key.

Skill content

Set PANGOLINFO_API_KEY (recommended). OR set PANGOLINFO_EMAIL + PANGOLINFO_PASSWORD to auto-fetch a key.

Recommendation

Prefer using PANGOLINFO_API_KEY. Only provide PANGOLINFO_EMAIL and PANGOLINFO_PASSWORD if you specifically need automatic key retrieval.

Low

#ASI03: Identity and Privilege Abuse

What this means

A cached permanent API key could be reused by later runs on the same machine.

Why it was flagged

The artifacts disclose an optional persistent local credential cache for the Pangolinfo API key.

Skill content

Optional caching (user must opt in): ... --cache-key ... This saves the key to ~/.pangolinfo_api_key (mode 0600)

Recommendation

Use caching only on a trusted personal machine, and delete ~/.pangolinfo_api_key if you no longer want the key stored locally.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Large or repeated scraping requests may spend account credits.

Why it was flagged

The skill's API calls can consume Pangolinfo credits, especially review-page requests.

Skill content

Review page (`--mode review`) | **5 per page** ... Credits are charged **only on success**

Recommendation

Set clear limits for pages, categories, sellers, or review scraping before asking an agent to run broad searches.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Your ASINs, keywords, seller IDs, category IDs, and review-scraping requests may be visible to the Pangolinfo service.

Why it was flagged

The included client sends requests to Pangolinfo's cloud API endpoint.

Skill content

API_BASE = "https://scrapeapi.pangolinfo.com"

Recommendation

Avoid sending product research or business-sensitive queries unless you are comfortable sharing them with Pangolinfo.