Top Risks

• Privacy policy fetched but scope_extension=false with data_collection+third_party_sharing=true — policy admits broad data sharing without scoping to this extension.
• DOM-XSS innerHTML sinks in 9 files including contentScript (runs on Google Docs/Sheets) with no CSP — amplified risk per FIX B.
• new Function() constructor in background and popup bundles with no CSP — dynamic code execution risk.
• brand_mention flags Google impersonation (confirmed_owner=false); extension name/description references Google Sheets/PPT.
• identity.email permission reads user Google account email; Slack webhook host_permission enables outbound data posting.

Evidence

• privacy_policy_scope_mismatch api Policy fetched (979KB), scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• dom_sink_innerhtml_no_csp crx 9 files with dom_sink_innerhtml_userctrl; csp_present=false triggers FIX B amplifier → +2.0 Code Quality per occurrence.
• function_constructor_no_csp crx new Function() in background+popup bundles; no CSP; scores +2.5 (function_constructor signal).
• brand_impersonation_google store brand_mention.is_impersonation=true, brands=['google'], confirmed_owner=false, not verified_publisher → +2.0 Reputation.
• featured_by_google store is_featured_by_google=true → -2.0 Reputation (Featured badge).
• mv3_no_csp manifest MV3 extension; no CSP defined. MV3 has strict default, no +2.0 Network penalty applied for MV2 absence.
• slack_host_permission manifest https://hooks.slack.com declared as permission; enables outbound POST to Slack webhooks from extension context.
• content_scripts_scoped manifest content_scripts limited to docs.google.com/presentation/* and docs.google.com/spreadsheets/* — matches stated function.

Permissions Breakdown

• identity low OAuth identity access; limited scope, but combined with identity.email elevates slightly.
• storage low Local extension storage only; standard low-risk permission.
• identity.email medium Reads user's Google account email; privacy concern if exfiltrated.
• https://hooks.slack.com medium Can post to Slack webhooks; could be used to exfiltrate data to Slack endpoints.

Pillar Scores

Bookkeeping