dygod-movies Security Report — Suspicious | ClawSafe

45 /100

dygod-movies

电影天堂影视爬虫技能 - 爬取电影天堂最新电影和电视剧信息，支持下载到群晖NAS

Movie crawler skill with legitimate functionality but multiple security misconfigurations including hardcoded credentials in documentation and code, unpinned dependencies, and unauthenticated API endpoints.

Skill Namedygod-movies

Duration49.4s

Enginepi

⚠

Use with caution

Remove hardcoded credentials from code and documentation. Use environment variables or secure credential storage. Add authentication to FastAPI endpoints. Pin dependency versions. Consider API key or session-based auth for NAS access.

Findings 5 items

Severity	Finding	Location
High	Hardcoded NAS credentials in documentation Credential Theft SKILL.md contains plaintext credentials for Synology NAS: account=xiaoai, passwd=Xx654321 at 192.168.123.223:5000 `curl.exe -s "http://192.168.123.223:5000/webapi/entry.cgi?api=SYNO.API.Auth&version=6&method=login&account=xiaoai&passwd=Xx654321` → Remove credentials from documentation. Use environment variables or configuration files for credentials.	`SKILL.md:120`
High	Hardcoded NAS credentials in source code Credential Theft scripts/dygod_crawler.py contains hardcoded Synology credentials at module level `SYNOLOGY_USER = "xiaoai" SYNOLOGY_PASS = "Xx654321"` → Move credentials to environment variables or secure config. Use os.getenv('SYNOLOGY_PASS') pattern.	`scripts/dygod_crawler.py:305`
Medium	Unpinned Python dependencies Supply Chain requirements.txt uses '*' for all versions, allowing automatic upgrades that could introduce vulnerabilities `requests>=2.32.0` → Pin exact versions: requests==2.32.3, beautifulsoup4==4.12.3, etc.	`service/requirements.txt:1`
Medium	Unauthenticated FastAPI endpoints Priv Escalation The /download and other endpoints have no authentication, allowing anyone to trigger downloads `@app.post("/download") def download(...)` → Add authentication middleware or API key validation to protect endpoints.	`service/main.py:170`
Low	Insecure example in documentation Doc Mismatch SKILL.md examples use curl.exe with credentials in URL query parameters, promoting insecure patterns `curl.exe -s -X POST -d "...&account=xiaoai&passwd=Xx654321..."` → Document secure credential handling and recommend environment-based configuration.	`SKILL.md:132`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`READ`	`WRITE`	✓ Aligned	SKILL.md:56 cache file writes
Network	`READ`	`READ`	✓ Aligned	scripts/dygod_crawler.py:73-84 HTTP GET requests
Shell	`NONE`	`NONE`	—	No subprocess/shell execution found
Environment	`NONE`	`NONE`	—	No environment variable access

1 High 138 findings

📡

High IP Address 硬编码 IP 地址

120.0.0.0

scripts/dygod_crawler.py:40

🔗

Medium External URL 外部 URL

http://192.168.123.223:5000/webapi/entry.cgi?api=SYNO.API.Auth&version=6&method=login&account=xiaoai&passwd=Xx654321&ses...

SKILL.md:120

🔗

Medium External URL 外部 URL

http://192.168.123.223:5000/webapi/DownloadStation/task.cgi

SKILL.md:132

🔗

Medium External URL 外部 URL

http://192.168.123.223:5000/webapi/DownloadStation/task.cgi?api=SYNO.DownloadStation.Task&version=1&method=list&addition...

SKILL.md:161

🔗

Medium External URL 外部 URL

http://192.168.123.223:5000/webapi/DownloadStation/task.cgi?api=SYNO.DownloadStation.Task&version=1&method=delete&id=TAS...

SKILL.md:167

🔗

Medium External URL 外部 URL

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd

data/gndy_index.html:1

🔗

Medium External URL 外部 URL

http://www.w3.org/1999/xhtml

data/gndy_index.html:2

🔗

Medium External URL 外部 URL

http://www.dygod.net

data/gndy_index.html:43

🔗

Medium External URL 外部 URL

http://www.dygod.net/

data/gndy_index.html:44

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260307/131013.html

data/movies_cache.json:6

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20101019/28863.html

data/movies_cache.json:34

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20070612/2906.html

data/movies_cache.json:39

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20130507/42183.html

data/movies_cache.json:64

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20160926/108530.html

data/movies_cache.json:90

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20110304/31168.html

data/movies_cache.json:116

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260313/131092.html

data/movies_cache.json:142

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20090208/16879.html

data/movies_cache.json:166

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260313/131091.html

data/movies_cache.json:192

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260313/131087.html

data/movies_cache.json:216

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260313/131085.html

data/movies_cache.json:240

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260313/131086.html

data/movies_cache.json:266

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260313/131089.html

data/movies_cache.json:290

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20210612/115133.html

data/movies_cache.json:316

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20100105/23821.html

data/movies_cache.json:342

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131083.html

data/movies_cache.json:368

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131082.html

data/movies_cache.json:394

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20141229/105608.html

data/movies_cache.json:420

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131077.html

data/movies_cache.json:446

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131076.html

data/movies_cache.json:472

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131075.html

data/movies_cache.json:498

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131074.html

data/movies_cache.json:522

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131073.html

data/movies_cache.json:546

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131066.html

data/movies_cache.json:570

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131067.html

data/movies_cache.json:594

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131068.html

data/movies_cache.json:618

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260312/131069.html

data/movies_cache.json:644

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20150806/106691.html

data/movies_cache.json:670

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20090301/17224.html

data/movies_cache.json:696

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260303/130943.html

data/movies_cache.json:722

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20131206/103704.html

data/movies_cache.json:748

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20140929/105156.html

data/movies_cache.json:773

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260227/130889.html

data/movies_cache.json:799

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260311/131062.html

data/movies_cache.json:826

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20070901/5368.html

data/movies_cache.json:851

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20090727/20542.html

data/movies_cache.json:877

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260311/131059.html

data/movies_cache.json:903

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260311/131060.html

data/movies_cache.json:929

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260310/131049.html

data/movies_cache.json:954

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260310/131055.html

data/movies_cache.json:980

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20070814/4857.html

data/movies_cache.json:1006

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260310/131050.html

data/movies_cache.json:1032

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260310/131051.html

data/movies_cache.json:1058

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20081007/14599.html

data/movies_cache.json:1084

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260309/131042.html

data/movies_cache.json:1110

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260310/131058.html

data/movies_cache.json:1136

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20190928/112428.html

data/movies_cache.json:1160

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260309/131040.html

data/movies_cache.json:1186

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260309/131038.html

data/movies_cache.json:1211

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/20260309/131037.html

data/movies_cache.json:1236

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20251213/129594.html

data/tv_cache.json:7

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260228/130900.html

data/tv_cache.json:13

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260309/131041.html

data/tv_cache.json:19

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260312/131084.html

data/tv_cache.json:25

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260312/131080.html

data/tv_cache.json:31

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260312/131079.html

data/tv_cache.json:37

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260312/131081.html

data/tv_cache.json:43

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260308/131032.html

data/tv_cache.json:49

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260312/131072.html

data/tv_cache.json:55

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260306/131003.html

data/tv_cache.json:61

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260226/130866.html

data/tv_cache.json:67

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260310/131056.html

data/tv_cache.json:73

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260226/130867.html

data/tv_cache.json:79

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260305/130972.html

data/tv_cache.json:85

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260307/131009.html

data/tv_cache.json:91

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260222/130837.html

data/tv_cache.json:97

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260312/131071.html

data/tv_cache.json:103

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260224/130858.html

data/tv_cache.json:109

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260121/130360.html

data/tv_cache.json:115

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260121/130362.html

data/tv_cache.json:121

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260311/131065.html

data/tv_cache.json:127

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260304/130958.html

data/tv_cache.json:133

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20260228/130905.html

data/tv_cache.json:139

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20251117/129222.html

data/tv_cache.json:145

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/hytv/20251014/128653.html

data/tv_cache.json:151

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260205/130589.html

data/tv_cache.json:157

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260205/130590.html

data/tv_cache.json:163

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260122/130363.html

data/tv_cache.json:169

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260116/130267.html

data/tv_cache.json:175

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260122/130376.html

data/tv_cache.json:181

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260115/130257.html

data/tv_cache.json:187

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260109/130100.html

data/tv_cache.json:193

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260304/130961.html

data/tv_cache.json:199

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260204/130558.html

data/tv_cache.json:205

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260114/130238.html

data/tv_cache.json:211

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260107/130067.html

data/tv_cache.json:217

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260114/130237.html

data/tv_cache.json:223

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260228/130899.html

data/tv_cache.json:229

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260120/130339.html

data/tv_cache.json:235

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260113/130217.html

data/tv_cache.json:241

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260113/130216.html

data/tv_cache.json:247

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260113/130215.html

data/tv_cache.json:253

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260202/130533.html

data/tv_cache.json:259

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260106/130038.html

data/tv_cache.json:265

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260112/130193.html

data/tv_cache.json:271

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260113/130198.html

data/tv_cache.json:277

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260301/130924.html

data/tv_cache.json:283

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260202/130539.html

data/tv_cache.json:289

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260118/130314.html

data/tv_cache.json:295

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/rihantv/20260217/130767.html

data/tv_cache.json:301

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20251021/128747.html

data/tv_cache.json:307

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260116/130279.html

data/tv_cache.json:313

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260306/130995.html

data/tv_cache.json:319

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260106/130033.html

data/tv_cache.json:325

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260312/131070.html

data/tv_cache.json:331

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260214/130705.html

data/tv_cache.json:337

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20250918/128200.html

data/tv_cache.json:343

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260110/130121.html

data/tv_cache.json:349

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260130/130478.html

data/tv_cache.json:355

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20251023/128788.html

data/tv_cache.json:361

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260109/130101.html

data/tv_cache.json:367

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260122/130364.html

data/tv_cache.json:373

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260305/130969.html

data/tv_cache.json:379

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20251026/128817.html

data/tv_cache.json:385

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260310/131054.html

data/tv_cache.json:391

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20251223/129769.html

data/tv_cache.json:397

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260225/130861.html

data/tv_cache.json:403

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260311/131063.html

data/tv_cache.json:409

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20201102/113893.html

data/tv_cache.json:415

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20251016/128692.html

data/tv_cache.json:421

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260302/130939.html

data/tv_cache.json:427

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260304/130960.html

data/tv_cache.json:433

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260309/131047.html

data/tv_cache.json:439

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20260309/131048.html

data/tv_cache.json:445

🔗

Medium External URL 外部 URL

https://dygod.net/html/tv/oumeitv/20251015/128675.html

data/tv_cache.json:451

🔗

Medium External URL 外部 URL

http://www.dygod.net/html/3gp/3gpmovie/

data/tv_index.html:1173

🔗

Medium External URL 外部 URL

https://dygod.net/html/gndy/dyzz/

scripts/dygod_crawler.py:5

🔗

Medium External URL 外部 URL

https://dygod.net

scripts/dygod_crawler.py:19

🔗

Medium External URL 外部 URL

https://www.dygod.net/html/tv/

service/main.py:153

File Tree

8 files · 236.6 KB · 4876 lines

HTML 2f · 1955L JSON 2f · 1712L Python 2f · 1000L Markdown 1f · 204L Text 1f · 5L

├─ ▾ 📁 data

│ ├─ 📄 gndy_index.html HTML 772L · 62.4 KB

│ ├─ 📋 movies_cache.json JSON 1258L · 52.9 KB

│ ├─ 📋 tv_cache.json JSON 454L · 17.9 KB

│ └─ 📄 tv_index.html HTML 1183L · 65.9 KB

├─ ▾ 📁 scripts

│ └─ 🐍 dygod_crawler.py Python 775L · 25.0 KB

├─ ▾ 📁 service

│ ├─ 🐍 main.py Python 225L · 6.7 KB

│ └─ 📄 requirements.txt Text 5L · 87 B

└─ 📝 SKILL.md Markdown 204L · 5.7 KB

Dependencies 5 items

Package	Version	Source	Known Vulns	Notes
`requests`	`>=2.32.0`	pip	No	Version not pinned
`beautifulsoup4`	`>=4.12.0`	pip	No	Version not pinned
`fastapi`	`>=0.115.0`	pip	No	Version not pinned
`uvicorn`	`>=0.32.0`	pip	No	Version not pinned
`httpx`	`>=0.27.0`	pip	No	Version not pinned

Security Positives

✓ No subprocess/shell execution capabilities

✓ No credential harvesting from system

✓ No base64 obfuscation or anti-analysis techniques

✓ No attempts to access ~/.ssh, ~/.aws, or other sensitive paths

✓ No external C2 communication or data exfiltration

✓ Clear documentation of intended web scraping functionality

✓ Uses standard libraries (requests, BeautifulSoup) for legitimate scraping

Scan Report

Findings 5 items

File Tree

Dependencies 5 items

Security Positives