☰

DUOLINGO INTEGRATION was reported 2026-08-01 for Undisclosed antifeature (e.g. ad, tracking, miner, etc.)

The reporter said:

Compliance Report: "DUOLINGO INTEGRATION" vs Greasyfork Rules

Script: DUOLINGO INTEGRATION (v2026.08.01b)

Link: https://greasyfork.org/en/scripts/586818-duolingo-integration

Review date: 2026-08-01

Reference sources: Greasy Fork's rules for posted scripts, Antifeatures policy, Script meta keys

1. Functional summary

The script injects a floating UI panel into duolingo.com with two modes:

  • "Get Super" panel: probes/exploits the Family Plan endpoint (/family-plan/invites) to fetch invite links, activates a free 3-day Super trial via the shop-items endpoint, and plays embedded YouTube music.
  • "Hacker" panel: farms XP by looping calls to the stories.duolingo.com API (simulating story completion for XP credit), farms gems by "consuming" unused reward entries via the rewards API, and inflates streak by creating/overwriting sessions with fabricated past startTime/endTime values.

Access is gated by a key system: FREE (limited daily "energy"), VIP (unlimited, key obtained from the admin via a Zalo group — implying an off-platform contact/payment step), and ADMIN (unlocked with a password + birthdate hardcoded directly in the client-side code: ADMIN_PW, ADMIN_DOB = '280714').

2. Comparison against "Rules for posted scripts"

2.1 Functionality

Rule Assessment
"Scripts must include a description of what they do and may not do things unreasonably outside of this description." Partially met. The @description field ("CREATE SUPER LINK, GET 3-DAY SUPER, LISTEN TO MUSIC, HACK XP/GEM/STREAK") does list the main functions present in the code. However, it never mentions the paid/VIP key system, the daily "energy" limit, or the hidden admin account — all things a user needs to know before installing, and none of this is disclosed in the metadata.
"Scripts must have a reason to be a script." Met. This is not a bare link; the script genuinely calls APIs and transforms the page.
"Scripts that contain features for the benefit of the author rather than the user... must be disclosed with @antifeature." NOT met — clearest violation. See Section 3 below.
"The primary functionality... must be within the code on Greasy Fork." Technically met, but the core of the "CREATE LINK" feature and all VIP/ADMIN gating logic depend on an external backend (auto-super.vercel.app) that is not part of the published code — the authorization/key-validation logic that matters most sits outside what Greasyfork or users can inspect.

2.2 Code

Rule Assessment
"Code posted... must not be obfuscated or minified... variable names retained." High risk / arguably in violation. The entire script uses maximally shortened variable/function names (_S, _G, $, L, r, u, j, h...), a single GM_addStyle call packs roughly 10,000 characters of CSS onto one line, and the UI is built from one giant unformatted innerHTML string. This isn't technical obfuscation (no eval, no encoded strings), but in spirit — "users must have the opportunity to inspect and understand a script before installing it" — the code is effectively unreadable by eye and is the kind of thing that gets flagged in manual review.
"Use of external JavaScript is limited." Met. No @require pulling in unclear external libraries; the @connect domains (duolingo.com, stories.duolingo.com, goals-api.duolingo.com, auto-super.vercel.app, greasyfork.org) are only used for XMLHttpRequest data calls, not for injecting external <script> tags.
"Scripts must not check for updates at a rate higher than once per day." Met. _checkVersion() is called only once per page load (setTimeout(_checkVersion, 2000) in init()), with no repeating loop.

2.3 Listing

Rule Assessment
"Script authors may not place advertising on pages on Greasy Fork... Promotion of author's homepage, Discord, etc. is allowed." Met, assuming the Greasyfork listing description only contains the Zalo link as a "support channel" (permitted), not paid third-party advertising.
"Scripts may not include @includes or @matches for sites they do not provide functionality on." Met. @match https://www.duolingo.com/* matches the entire feature set.

2.4 Copyright

Rule Assessment
"Your script must respect others' copyrights... including resources (e.g. images)." Worth flagging. @icon points directly to Duolingo's official icon (d35aaqx5ub95lt.cloudfront.net/.../38dc6a042b0de3f6aeb44ff2aa70de73.svg), which makes the script look like an official/endorsed Duolingo product — a brand-confusion risk, though using a platform's own icon for a script that interacts with that platform is common on Greasyfork and generally tolerated.

2.5 Miscellaneous

No adult content; no obvious keyword spam in the provided code.

3. Comparison against Antifeature Policy — the main violation

Per the Antifeatures page, the following antifeatures must be declared via @antifeature if present:

  • @antifeature membership — "The script requires the user pay the script author for the script to be fully functional" or requires a separate login/contact step to unlock full functionality.
  • @antifeature payment — the script is only fully functional if the user pays.

The script currently declares no @antifeature at all in its header, yet it clearly has a FREE/VIP/ADMIN gating structure:

  • FREE users are capped at 25 "energy" per day, can't access the unlimited Hacker panel, and can't listen to music.
  • To get VIP (unlimited energy), users must contact a Zalo group to obtain a key — this is exactly the pattern the rule describes: "support/key is required for the user to have full functionality."
  • There is a hidden ADMIN account with a password/birthdate hardcoded into the client-side code — not an antifeature by GF's definition, but an undisclosed backdoor that undermines the transparency the "users must know what a script will do before installing" rule is meant to protect.

→ Conclusion: The script is missing at minimum an @antifeature membership tag (and possibly @antifeature payment, if the VIP key genuinely requires payment via Zalo — something that can't be confirmed from the code alone). This is the clearest and most direct violation of Greasyfork policy.

4. Risks outside the written rules (but relevant to the script's survival on the platform)

These aren't formal Greasyfork rules, but are factors moderators commonly weigh when reviewing community reports:

  • Exploiting bugs to farm virtual resources (XP/Gems/Streak) and generate unauthorized Family Plan invite links violates Duolingo's Terms of Service and risks getting users' accounts banned. Greasyfork doesn't categorically ban "cheat scripts," but third-party exploit scripts tend to attract more reports and get removed at a higher rate when the community flags them for harming end users (account loss) — even though the code itself contains no malware.
  • Reliance on an undisclosed external backend (auto-super.vercel.app) for key validation: users have no way to verify what the authorization/VIP logic actually does server-side; they can only trust the author. This runs counter to Greasyfork's core transparency principle, even though there's no explicit rule against it as long as the client-side code isn't loading executable code from that source.

5. Summary

Category Status
Description matches core functionality Met
Has a valid reason to be a userscript Met
No unauthorized external executable code loaded Met
Update check frequency ≤ once/day Met
No advertising on the Greasyfork listing page Met (per description)
@antifeature declared for paid/membership system (VIP) Not met — violation
Code not obfuscated/minified in spirit Risk — extremely condensed, hard-to-read code style
Admin backdoor disclosed in description Not disclosed
Icon uses Duolingo's official logo Risk — brand confusion

Most important fix for compliance: add @antifeature membership (and payment if applicable) to the metadata header, and update @description to disclose the FREE tier's limits and how/under what conditions a VIP key is obtained.

trung nghĩa nguyễn (the reported user) has made:

This report has been upheld by a moderator.