Top Risks

• Privacy policy URL unreachable (fetch_error) — no visibility into data collection/retention.
• Install URL redirect to developer site (pixelstech.net) — potential tracking/analytics hijack.
• DOM-XSS sinks in Readability.js and content.js with CSP present — mitigates but does not eliminate risk.
• new Function() in html2canvas-pro.min.js — code execution primitive in rendering path.
• Description mismatch: promises recording but lacks tabCapture/desktopCapture permissions.

Evidence

• broad_host_access crx host_permissions and content_scripts both <all_urls>; justified for Screenshot category.
• verified_featured store verified_publisher=true AND is_featured_by_google=true; reputation floor 2.0.
• privacy_fetch_error api privacy_policy_classification.fetched=false (HTTPError); privacy pillar scored 10.0.
• install_url_hijack crx install_url_hijack=true; target=https://www.pixelstech.net/application/pagesaver?action=install.
• csp_present crx content_security_policy present for extension_pages and sandbox; script-src 'self' for main.
• code_findings crx 3 findings: 2x innerHTML sinks, 1x new Function; obfuscation_score=0.0.
• no_cves api cve_findings_raw empty; js_libraries_detected empty.
• active_maintenance store months_since_update=0; last_updated October 19, 2026.

Permissions Breakdown

• activeTab low Grants access to active tab on user gesture; standard for screenshot tools.
• scripting medium Can execute scripts in pages; required for content extraction.
• downloads medium Can download files to user system; needed for PDF/screenshot saving.
• contextMenus low Adds context menu items; low risk.
• tabs medium Can read tab metadata and URLs; moderate privacy exposure.
• windows low Window management; typically for popup/overlay UI.
• storage low Local storage only; low risk.
• <all_urls> high Broad host access; justified for screenshot/PDF category.

Pillar Scores

Bookkeeping