DeepSeek Custom GPTs
aadlmimdcdpifjpbpbnjjoiboohnekeb
Risk Score
5.38
Risk Level:
Medium
Recommendation:
🟡 MEDIUM RISK — review
Top Risks
- DeepSeek brand impersonation by unverified gmail developer — confirmed is_impersonation=true with no verified ownership.
- Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — scores maximum privacy risk.
- Extension contacts anthonyc.gumroad.com (commercial/monetization platform) alongside chat.deepseek.com with no CSP.
- Free-webmail developer (gmail) with no business website, low installs, and below-average rating raises accountability concerns.
- Stale 16 months with no CSP and AI category — content scripts on DeepSeek chat sessions could exfiltrate conversation data if compromised.
Evidence
- brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=['deepseek']; developer_domain=gmail.com; confirmed_owner=false.
- privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy.
- free_webmail_developer store Developer email anthony.cardinale06+cws@gmail.com; no verified publisher; no business domain; developer_name='Anthony'.
- gumroad_external_host crx js_external_hosts includes anthonyc.gumroad.com — commercial storefront, possible monetization/upsell vector.
- no_csp manifest content_security_policy=null on MV3 extension with external host contacts; v2 fix (b) does not apply to MV3 but raises exposure.
- ai_extension_page_content manifest Content script on chat.deepseek.com/* processes AI session content; is_ai_extension=true adds Webstore +2.5.
- maintenance_stale store months_since_update=16; falls in 12-24mo band → +6.0 maintenance.
- low_rating store Rating 3.2; rating_count unknown; below average for category.
Permissions Breakdown
- activeTab medium Grants access to the active tab on user action; scoped, but combined with content_script on chat.deepseek.com.
- content_scripts: https://chat.deepseek.com/* medium Injects JS into DeepSeek chat pages; narrow scope limits blast radius but touches AI session data.
Pillar Scores
Permissions1.50
Reputation8.50
Network2.00
Webstore4.50
Maintenance6.00
Privacy10.00
Code Quality0.00
CVE Exposure0.00
Bookkeeping
Rubric v3.6
Scored at 2026-06-16 07:14
Listing SHA
b9f0b1e8465c…
Force block
— not fired
Score recovered
no
Elapsed
25.8s