Top Risks

• Privacy policy admits data collection & third-party sharing but is not scoped to this extension — v3.5 D applies (+10.0 privacy).
• Brand impersonation: extension is named/themed around Instagram without confirmed ownership; is_impersonation=true.
• cookies permission + full Instagram host access enables session-cookie exfiltration.
• Developer domain slashed.io does not resolve; verified-publisher discount capped per invariant 0c.
• 11 external JS hosts including unpkg.com, raw.github.com, stuartk.com — broad third-party CDN surface.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[instagram], confirmed_owner=false.
• privacy_policy_broad_admission api scope_extension=false, data_collection=true, third_party_sharing=true → v3.5D +10.0 privacy.
• developer_domain_not_resolving api slashed.io resolves=false; verified-publisher discount capped at -1.0 per invariant 0c.
• cookies_high_perm_with_host manifest cookies + *://*.instagram.com/* enables Instagram session-cookie access.
• external_js_hosts_broad crx 11 external hosts including unpkg.com, raw.github.com, stuartk.com, stuk.github.io outside dev control.
• function_constructor_in_bundled_lib crx new Function() in js/jszip.min.js; bundled lib, limited scope but dynamic code execution path.
• verified_publisher store verified_publisher=true but domain does not resolve; discount capped to -1.0 per 0c.
• no_developer_name store developer_name is empty string; reduced accountability signal.

Permissions Breakdown

• alarms low Scheduled background tasks; low direct harm potential.
• background low Persistent background page; needed for Instagram client function.
• cookies high Can read/write Instagram session cookies; session hijack risk paired with host access.
• declarativeNetRequest medium Can block/modify network requests; lower risk than webRequestBlocking but still capable.
• offscreen low Offscreen document for media ops; limited standalone risk.
• unlimitedStorage low Unlimited local storage; no direct privacy harm.
• *://*.instagram.com/* high Full access to Instagram pages; combined with cookies raises session-theft risk.
• *://*.inssist.com/* medium Access to developer's own domain; data relay risk.

Pillar Scores

Bookkeeping