Scrape Amazon as JSON — products, keywords, reviews, BSR. 13 regions. Anti-bot. 60 free credits. Claude Code, Cursor, LangChain.
Security Analysis
high confidenceThe skill's code, instructions, and required items are consistent with an Amazon-scraping client that calls the Pangolinfo API; nothing in the package indicates covert or unrelated behavior.
Name/description claim scraping Amazon via Pangolinfo API; the package contains a Python client that POSTs to scrapeapi.pangolinfo.com and an auth endpoint — these are coherent with the stated purpose. Required binary (python3) is appropriate.
SKILL.md instructs the agent to obtain and use an API key (or email+password to obtain one) and to verify with --auth-only. The instructions do not request unrelated files, system secrets, or other services, and the script's behavior (auth, scrape calls, error handling) matches the guidance.
No install spec (instruction-only) and included scripts are plain Python/bash. Nothing is downloaded or written to nonstandard system locations by default. This is a low-risk install footprint.
The metadata lists PANGOLINFO_API_KEY, PANGOLINFO_EMAIL, and PANGOLINFO_PASSWORD as required, but the client primarily uses the API key (primaryEnv) and supports email+password only as an alternative to fetch an API key. Requesting an account password is functionally explainable but is sensitive — prefer using the API key. The client may optionally cache a key to ~/.pangolinfo_api_key if caching is enabled; this persistence is limited and explained in docs.
always:false and model-invocation allowed (defaults) — normal. The client can optionally write an API key to ~/.pangolinfo_api_key (mode 0600) when caching is enabled; otherwise it does not persist credentials. No modification of other skills or system-wide agent settings is present.
Guidance
This package appears to be a straightforward Pangolinfo API client. Before installing, consider: (1) Prefer providing PANGOLINFO_API_KEY rather than PANGOLINFO_EMAIL/PANGOLINFO_PASSWORD — storing passwords in env vars is sensitive. (2) The client can optionally save an API key to ~/.pangolinfo_api_key if you enable caching; avoid enabling that if you don't want the key on disk. (3) Self-test and --auth-only operations will contact the Pangolinfo service and may consume credits if live tests are enabled; keep RUN_LIVE_TESTS off unless you intend to use credits. (4) Verify you trust the Pangolinfo service (pangolinfo.com and scrapeapi.pangolinfo.com) and review its privacy/terms if you will send account credentials. (5) The metadata lists all three env vars as required, but only an API key is normally needed; be aware of that minor discrepancy.
Latest Release
v2.0.2
**Major update with a simplified description, improved onboarding, and clearer agent instructions.** - Shortened the description for clarity; highlighted JSON extraction, 13 Amazon regions, anti-bot, and 60 free credits. - Added a license field and clarified Python/CLI dependencies. - Expanded API onboarding instructions for agents, ensuring proper credential flow and first-time user guidance. - Detailed supported marketplaces and all 9 API parsers, including credits required per operation. - Provided sample outputs (success and errors) and explicit error handling rules for agents. - Added concise usage recipes and improved prompt suggestions. - Markedly restructured and condensed all documentation for easier agent and user integration.
More by @pangolinfo
Published by @pangolinfo on ClawHub
