Even if you need to be high role clan player to setup you can, and should, use a secondary account, with no special role, in the clan to extract information.
You do not have to do it but it should give you peace of mind if you do it.
What can we do and how can we misuse it? Basically, assume we see and do what the person whose information is extracted from can see and do and do most of the same tasks. We believe the worst thing we can do to this account is to use the resources.
What can we not do? Even if you are a commander, we can not rename your account or your clan account for these actions require password confirmation. We can not steal your account and change the login access. Once again, it requires confirmation via either email or password.
For this method, it does not matter if you have 2-factor authentication so I recommend you activate it too, again, for the sake of peace of mind.
Lastly, this method is dependent on cookie expiration time so you may need to repeat the process after some time. In testing, cookie persisted over half a year, only becoming obsolete when Wargaming made everyone's cookie expire during the Team Consumables fiasco.