Top Risks

• Privacy policy fetched but does not scope collection to this extension, admits third-party sharing — scores maximum privacy risk.
• Brand impersonation signal: extension mentions 'roblox' but developer is not confirmed owner; not verified publisher.
• No CSP present (MV3 default strict but no explicit policy); innerHTML sinks without CSP raise DOM-XSS risk.
• No developer name listed; identity accountability gap for a 3M-install extension.
• Content scripts run across all roblox.com pages — broad reach into a gaming platform used heavily by minors.

Evidence

• privacy_policy_scope_extension_false_with_third_party_sharing api Privacy policy fetched but scope_extension=false AND third_party_sharing=true — triggers +10.0 privacy per v3.5 rule D.
• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[roblox], confirmed_owner=false, not verified_publisher — +2.0 reputation.
• no_developer_name store developer_name is empty string; no 'Offered by' name visible — +1.0 reputation.
• dom_xss_sinks_no_csp crx Two innerHTML-userctrl findings; csp_present=false triggers FIX B: dom_sink elevated to +2.0 code quality.
• high_install_count store 3,000,000 installs — +1.0+1.0+0.5 webstore reach signals; also -0.5 popularity-trust at 4.7 rating.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount ('Follows recommended practices').
• content_scripts_roblox_only manifest All content_scripts_matches scoped to *.roblox.com and *.ropro.io — no scope mismatch penalty.
• cve_findings_empty crx cve_findings_raw=[]; jquery 3.5.1 bundled but no CVEs flagged by scanner — CVE pillar 0.0.

Permissions Breakdown

• notifications medium Can display system notifications; medium risk when paired with host access.
• storage low Local data persistence only; standard low-risk permission.
• alarms low Scheduling callbacks; no direct data access.
• https://*.roblox.com/* medium Scoped to roblox.com only; matches stated function as Roblox enhancer.
• https://roblox.com/* medium Same as above, apex domain variant.
• https://*.ropro.io/* low Developer's own domain; necessary for CDN/API calls.
• https://ropro.io/* low Developer's own domain apex variant.
• https://*.rbxcdn.com/* low Roblox CDN domain; consistent with Roblox enhancement function.

Pillar Scores

Bookkeeping