Top Risks

• Brand impersonation: extension claims Reddit/Google affiliation without verified ownership.
• Content scripts injected into ChatGPT, Claude — scope mismatch with stated Reddit scraper function.
• 6x innerHTML sinks across content scripts with CSP present but no DOM sanitization — XSS risk.
• Contacts tryadlicio.com and hookcollective.com (not disclosed in listing) alongside Reddit scraping.
• Install URL hijack detected; no developer name listed; unverified publisher.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands reddit+google mentioned; confirmed_owner=false.
• content_script_scope_mismatch manifest content_scripts_matches includes ChatGPT and Claude — unrelated to stated Reddit scraping purpose.
• undisclosed_external_hosts crx js_external_hosts includes tryadlicio.com, hookcollective.com, www.amazon.com — not in host_permissions or description.
• install_url_hijack crx install_url_hijack=true; target=null. Extension opens a URL on install.
• dom_xss_sinks crx 6 innerHTML-from-variable findings across content.js, display.js, auth-ui.js, history-ui.js, comment-scraper.js.
• telemetry_collection manifest host_permissions include both posthog US and EU endpoints and opaque Supabase backend.
• no_developer_name store developer_name is empty string; email daniel@ddtechsolution.com; not verified publisher.
• privacy_policy_third_party_sharing api privacy_policy_classification: scope=true, data_collection=true, third_party_sharing=true, retention=true.

Permissions Breakdown

• activeTab low Grants access to current tab only on user action; low blast radius.
• scripting medium Allows dynamic script injection into pages; medium risk, scoped by host_permissions.
• storage low Local data persistence; no cross-origin exposure.
• identity low OAuth token access; no scopes declared beyond extension identity.
• *://*.reddit.com/* medium Broad host on Reddit; matches stated scraping function.
• https://hacker-news.firebaseio.com/* medium Hacker News API access; not described in listing but low sensitivity.
• https://qaottociftsaoepttyhm.supabase.co/* medium Supabase backend — user data likely stored here; opacity risk.
• https://us.i.posthog.com/* medium PostHog analytics telemetry endpoint; user behaviour tracking.
• https://eu.i.posthog.com/* medium PostHog EU analytics endpoint; dual-region telemetry collection.

Pillar Scores

Bookkeeping