Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — admits data sharing with no extension-specific scope.
• Brand impersonation: 'instagram' mentioned in name/description; developer is not a confirmed Instagram/Meta owner.
• Low rating (2.6) signals user dissatisfaction; extension operates on Instagram DOM via content script.
• No CSP present (MV3 so no +2.0 network penalty, but combined with content-script access raises injection risk).
• Instagram content-script enables mass-follow/unfollow/like automation, potential ToS violation against Instagram.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'instagram' in name; confirmed_owner=false. +2.0 Reputation.
• generic_privacy_policy store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0.
• low_rating store Rating 2.6; no rating_count supplied so +1.0 reputation rule not applied (insufficient evidence).
• content_script_instagram manifest content_scripts_matches=['https://www.instagram.com/*']; full DOM access to Instagram pages.
• no_csp crx content_security_policy=null; MV3 so no +2.0 network penalty, but no sandbox protection.
• no_code_findings crx code_findings_raw=[] and obfuscation_score=0.0; code quality score=0.0.
• threat_intel_clean api bad_host_hits=[], affiliate_hits=[], monetization_hits=[]; developer domain resolves, not throwaway.
• recently_updated store months_since_update=0; maintenance score=0.0.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• unlimitedStorage low Removes storage quota; no direct data exfil risk.
• content_scripts https://www.instagram.com/* medium Injects JS into Instagram; can read/modify all Instagram page content.

Pillar Scores

Bookkeeping