Top Risks

• Abandoned extension: last updated 52 months ago, no maintenance signal.
• Privacy policy is Google's generic account policy — no extension-specific scope, admits data collection and 3rd-party sharing.
• Content scripts injected on all HTTP/HTTPS URLs despite minimal declared permissions.
• Gmail developer identity, no verified publisher, no business domain.
• Google Tag Manager endpoint in JS external hosts suggests telemetry reporting from all visited pages.

Evidence

• stale_extension store Last updated February 14, 2022 — 52 months ago. No changelog or active maintenance indicators.
• generic_privacy_policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_content_scripts manifest content_scripts_matches covers http://*/* and https://*/* — all pages — despite only storage+activeTab declared.
• gmail_developer store Developer email lmv.developer.tools@gmail.com; no verified publisher badge; no business domain.
• monetization_host crx www.googletagmanager.com present in JS external hosts — telemetry/analytics endpoint.
• function_constructor crx new Function('return this') found in bundled chunk; low risk in isolation but warrants note.
• no_csp manifest content_security_policy is null for MV3 extension; reduces isolation guarantees.
• autodesk_domain crx lmv.ninja.autodesk.com in external hosts — suggests Autodesk LMV viewer tooling, consistent with DeveloperTools category.

Permissions Breakdown

• storage low Local key-value store only; no cross-site data exposure.
• activeTab low Grants access to current tab only on explicit user action.
• content_scripts http://*/* https://*/* medium Broad content-script injection into all HTTP/HTTPS pages elevates reach significantly.

Pillar Scores

Bookkeeping