Dygod Movies

• Analyzed: May 11, 2026, 7:16 AM
• Findings: 1
• Version: 1.0.0
• Hash: d34b6007584f06590cbf2336aece016ffdec9391a52a33e17a1008bcdafa25c9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains hardcoded plaintext credentials (username 'xiaoai' and password 'Xx654321') and a specific local network IP address (192.168.123.223) for a Synology NAS within both SKILL.md and scripts/dygod_crawler.py. While the code appears to be a functional tool for crawling movie data and automating downloads via the Synology DownloadStation API, the inclusion of sensitive authentication data and hardcoded infrastructure details is a significant security vulnerability. No evidence of intentional malice or unauthorized data exfiltration was found, suggesting these may be remnants of a specific user's configuration or a poorly secured template.