Top Risks

• Generic freeprivacypolicy.com policy not scoped to this extension; admits data collection and 3rd-party sharing → Privacy pillar 10.0.
• WhatsApp brand impersonation by unverified gmail developer with no confirmed ownership.
• Extension stale 15 months; no verified publisher, no featured badge.
• dom_sink_innerhtml_userctrl in overlay.js without CSP; DOM-XSS risk on WhatsApp session.
• External JS host sheetjs.com loaded from content running inside WhatsApp Web session.

Evidence

• privacy_policy_generic store freeprivacypolicy.com template; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (rule D).
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is gmail user, confirmed_owner=false → +2.0 Reputation.
• free_webmail_developer store Developer email harikabhaskaram31@gmail.com; no business domain; dev name matches email prefix → +1.5 Reputation.
• dom_xss_sink_no_csp crx innerHTML sink in overlay.js; csp_present=false → +2.0 Code Quality (FIX B).
• external_js_host_sheetjs crx js_external_hosts includes sheetjs.com; extension loads external JS inside WhatsApp Web context.
• maintenance_stale store months_since_update=15; falls in 12-24mo band → +6.0 Maintenance.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; 5 installs, 0 ratings.
• wayback_no_data api wayback_ownership fetch_error; no ownership-change signal available.

Permissions Breakdown

• scripting medium Can inject JS into allowed hosts; scoped to web.whatsapp.com only.
• host: https://web.whatsapp.com/* medium Narrow host scope to WhatsApp Web; fits stated bulk-messaging function.

Pillar Scores

Bookkeeping