Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Magic Actions For Youtube + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy admits data collection AND third-party sharing but is not scoped to this extension — scores maximum privacy risk.
• Brand impersonation: extension name uses YouTube™ trademark; developer (mixesoft.com) is not YouTube/Google.
• Manifest source is html_fallback — exact permission surface unknown, cannot confirm declared scope.
• No developer name listed in store; only email present, reducing accountability.

Evidence

• privacy_policy_classification api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy per v3.5 rule D.
• brand_impersonation store brand_mention.is_impersonation=true; YouTube trademark in title; developer is mixesoft.com, not Google/YouTube.
• verified_publisher store verified_publisher=true; provides reputation discount but capped by monetization/stale checks (none triggered here).
• manifest_source_fallback store manifest_source=html_fallback; js_files_scanned=0; actual permissions and code surface unverifiable.
• developer_name_missing store developer_name is empty string; reduced accountability signal.
• maintenance store months_since_update=8; falls in 6-12mo band → +3.5 maintenance score.
• operator_cluster api sibling_count=0 by compound fingerprint; dev_email dimension shows 2 but compound=0, no cluster penalty applied.
• threat_intel_clean api No bad_host_hits, affiliate_hits, or monetization_hits; developer domain resolves and is not throwaway.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Magic Actions For Youtube + malext.io malicious_extension_sentry; score 4.02 -> 6.52 (+2.5 cap 2.5).

Permissions Breakdown

• manifest_source:html_fallback medium Manifest parsed from HTML fallback; exact permissions unknown — scored conservatively.

Pillar Scores

Bookkeeping