Pangolinfo Amazon Scraper

Scrape Amazon product data using Pangolin APIs. Use this skill when the user wants to: look up Amazon products by ASIN, search Amazon by keyword, check bests...

This skill appears to do what it says (talk to Pangolin's scrape API) but take these precautions before installing or using it: 1) Verify the source — there is no homepage and the registry metadata omits the required env vars; confirm you trust the publisher or inspect the included scripts yourself. 2) Be aware it will ask for your Pangolin API key (or email+password) and will cache a permanent token at ~/.pangolin_api_key. If you are uncomfortable with a long-lived token stored in your home directory, do not provide credentials. 3) Avoid copying credentials directly into shell history. Prefer setting PANGOLIN_API_KEY in the session environment and let the script save it (then unset the env vars), or create the cache file via a secure method (use a secure editor, echo redirected from a file descriptor, or a secrets manager). 4) Consider creating a limited/test Pangolin account or API key with minimal credits before supplying real credentials. 5) If you proceed, review the scripts/pangolin.py file yourself (it is included) to confirm endpoints, behavior, and that nothing unexpected is transmitted. 6) Ask the publisher for a homepage/repository and more provenance if you need higher assurance. If you want, I can point out the exact lines in scripts/pangolin.py that perform caching and network calls and suggest safer ways to provide credentials.

Type: OpenClaw Skill Name: pangolin-amazon-scraper Version: 1.0.2 The skill bundle provides a functional client for the Pangolin Amazon Scraper API but employs high-risk patterns for credential management. Specifically, SKILL.md instructs the AI agent to execute shell commands (e.g., using echo to write to ~/.pangolin_api_key) with user-provided input, which creates a shell injection vulnerability. While the Python script (scripts/pangolin.py) includes basic security measures like restricted file permissions (chmod 600), the overall approach of directing an agent to perform filesystem and environment modifications via shell interpolation is risky, even if intended for legitimate setup purposes.