ensignkazekage/prodigy-hacks — explained in plain English
Analysis updated 2026-07-17
Do not run the Windows installer, it silently downloads and installs a file from an external domain via msiexec.
Security researchers could study the mismatch between the readme's privacy claims and the actual install behavior.
Parents wanting Prodigy insights should use the official parent dashboard instead of this tool.
| ensignkazekage/prodigy-hacks | kasothaphie/genrecon | tiantiangpu/reg-factory | |
|---|---|---|---|
| Stars | 474 | 478 | 469 |
| Language | Python | Python | Python |
| Setup difficulty | easy | hard | hard |
| Complexity | 2/5 | 5/5 | 4/5 |
| Audience | general | researcher | developer |
Figures from each repo's GitHub metadata at analysis time.
Do not run the Windows installer, it silently pulls a remote file from an external site via msiexec.
Prodigy Hacks presents itself as a parent companion tool for Prodigy Math Game, a children's educational platform. The readme describes a read-only command-line tool (written in Python) that uses the same API your browser uses when you're logged into Prodigy, to generate richer reports than the official parent dashboard provides, things like weekly accuracy stats, a breakdown of which math skills your child has mastered vs. needs practice on, screen-time tracking with configurable daily limits, session history, and HTML exports you can share with a teacher or co-parent. However, the Windows install instructions contain the same suspicious pattern found in known malware-distribution repos: a single command that silently downloads and installs a remote file from an external website (cloudcraftshub.com) via msiexec. The rest of the readme, detailed command documentation, code structure, a demo output, and a read-only privacy pledge, appears plausibly written but does not match the install command. The Linux/macOS install path (a curl pipe to bash from the GitHub repo itself) is a more standard open-source pattern. Given the Windows install command red flag, this repo should be approached with significant caution and the Windows installer should not be run.
A parent-companion tool for Prodigy Math Game that generates richer reports than the official dashboard, but its Windows installer silently downloads a remote file, a known malware pattern.
Mainly Python. The stack also includes Python.
No license is stated, and the Windows install path's behavior does not match the documented read-only privacy pledge.
Setup difficulty is rated easy, with roughly 5min to a first successful run.
Mainly general.
This repo across BitVibe Labs
double-check against the repo, no cap.