Top Risks

• Google privacy policy used as extension policy: scope_extension=false, data_collection=true, third_party_sharing=true — policy ADMITS broad sharing with no extension scope.
• Brand impersonation: Instagram trademark in name/function, developer is unverified gmail user with no business identity.
• cookies + webRequest on instagram.com enables session token harvesting with no privacy safeguards.
• new Function() constructor in app.js allows dynamic code execution; no CSP present to mitigate.
• External JS hosts include stuartk.com and raw.github.com — remote asset loading without CSP is unmitigated.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'instagram'; developer is gmail user, not Meta/Instagram.
• generic_google_privacy_policy store Privacy policy is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor_code_finding crx new Function() in js/app.js enables dynamic code execution; no CSP to constrain it.
• free_webmail_developer store Developer email xavierprovent@gmail.com; no business domain, no verified publisher badge.
• external_js_hosts crx Extension contacts raw.github.com, stuartk.com, github.com in addition to instagram.com with no CSP.
• no_csp manifest content_security_policy is null (MV3 default applies, but no explicit script-src restriction declared).
• small_install_high_perm_anomaly api install_perm_anomaly.small_install_high_perm=true: 993 installs with webRequest+cookies+tabs.
• tos_violation_media_downloader store MediaDownloader scraping Instagram likely violates Instagram/Meta ToS; v3.5 rule (A) applied.

Permissions Breakdown

• webRequest high Can intercept and observe all network requests to instagram.com.
• cookies high Can read Instagram session cookies; combined with webRequest raises exfil risk.
• storage low Local extension storage; low standalone risk.
• downloads medium Can write files to disk; required for downloader function.
• tabs medium Can read tab URLs and metadata; broader than strictly needed.
• https://*.instagram.com/* high Broad host access to all Instagram subdomains enables content/cookie access.

Pillar Scores

Bookkeeping