Top Risks

• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — worst-case privacy posture.
• Uninstall URL hijack to 10xprofit.io/tools signals traffic-monetization pattern.
• Brand impersonation: extension mentions Amazon but developer domain is gmail.com with no confirmed ownership.
• Free-webmail developer email (gmail) with no verified business identity; domain_age_ct skipped.
• Geo-diversity of 4 countries (CN, FR, IE, US) for an Amazon calculator raises unexplained infra footprint.

Evidence

• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) +10.0 privacy.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://10xprofit.io/tools — webstore +3.0 traffic-monetization signal.
• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false, not verified publisher → reputation +2.0.
• free_webmail_developer store Developer email 10xprofitio@gmail.com; no verified publisher badge → reputation +1.5.
• host_geo_diversity api JS hosts span 4 countries (CN, FR, IE, US); category=Shopping not exempt → network +1.5.
• no_csp manifest content_security_policy is null on MV3; no CSP amplifier applicable (MV3 strict default, no CVEs).
• maintenance_3_to_6_months store months_since_update=8 → maintenance +3.5 (6-12 month band).
• install_url_hijack crx onInstalled opens src/welcome/welcome.html — internal page, low risk but pattern noted.

Permissions Breakdown

• storage low Stores user settings/preferences locally; low risk in isolation.
• *://*.amazon.com/* (and 20 other amazon TLDs) medium Content scripts injected into all Amazon storefronts; scoped to stated function but broad across domains.

Pillar Scores

Bookkeeping