Workflow for new importer plugin – your advices?

Don’t even start.

Ignoring official API is a no go, at best it will just creat headache for you and nasty surprise for the users when the plugin will fail when pinterest changes something and since it forces you to…..

store user and password in a very unsecure way. This might be ok if your pugin is aimed to be run only for admins of non network wordpress or the super admin of a network, but if you aim to let users with restricted access to use it as well, then they might just send their pinterested user and password directly to the admin of the site. No one with security awareness will be willing to use your plugin.