Top Risks

• Privacy policy admits data collection AND third-party sharing but is not scoped to this extension — scores maximum privacy risk.
• Brand impersonation: extension name uses YouTube™ trademark; developer (mixesoft.com) is not YouTube/Google.
• Manifest source is html_fallback — exact permission surface unknown, cannot confirm declared scope.
• No developer name listed in store; only email present, reducing accountability.
• 700K installs create large blast radius if policy/ownership changes adversely in future.

Evidence

• privacy_policy_classification api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy per v3.5 rule D.
• brand_impersonation store brand_mention.is_impersonation=true; YouTube trademark in title; developer is mixesoft.com, not Google/YouTube.
• verified_publisher store verified_publisher=true; provides reputation discount but capped by monetization/stale checks (none triggered here).
• manifest_source_fallback store manifest_source=html_fallback; js_files_scanned=0; actual permissions and code surface unverifiable.
• developer_name_missing store developer_name is empty string; reduced accountability signal.
• maintenance store months_since_update=8; falls in 6-12mo band → +3.5 maintenance score.
• operator_cluster api sibling_count=0 by compound fingerprint; dev_email dimension shows 2 but compound=0, no cluster penalty applied.
• threat_intel_clean api No bad_host_hits, affiliate_hits, or monetization_hits; developer domain resolves and is not throwaway.

Permissions Breakdown

• manifest_source:html_fallback medium Manifest parsed from HTML fallback; exact permissions unknown — scored conservatively.

Pillar Scores

Scoring History

Bookkeeping