Top Risks

• declarativeNetRequestWithHostAccess + <all_urls>: can silently redirect or modify every HTTP request the user makes.
• Privacy policy is Google's generic account policy — not scoped to this extension at all; admits data collection and third-party sharing.
• Free-webmail Gmail developer with no verified publisher badge and no business identity.
• No CSP on MV3 extension with content scripts running on all URLs.
• js_external_hosts includes aim.cloudflare.com and speed.cloudflare.com — outbound beaconing surface unexplained by stated function.

Evidence

• HIGH permission: declarativeNetRequestWithHostAccess + <all_urls> manifest Can redirect or block any HTTP request on any site; core risk surface for traffic hijacking.
• Content scripts on <all_urls> manifest Injected JS runs on every page visited; broadens DOM access beyond stated header-management function.
• Privacy policy is generic Google account policy store URL points to myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• Free-webmail developer, no verified publisher store hunkiepeanut.dev@gmail.com; no business domain, no verification badge, no featured badge.
• External JS hosts: aim.cloudflare.com, speed.cloudflare.com crx Two Cloudflare endpoints referenced; purpose unexplained. example.com and foo.bar suggest test artifacts left in prod.
• No CSP declared manifest csp_present=false; MV3 default CSP applies but no explicit hardening for content scripts.
• Zero installs, zero ratings store No install traction and no user feedback; tail-attack-surface profile.
• Obfuscation score 0, no code findings crx 6 JS files scanned cleanly; no dynamic eval, no exfil indicators detected.

Permissions Breakdown

• storage low Local config persistence; low risk.
• declarativeNetRequestWithHostAccess high Can intercept/modify/redirect all HTTP requests across every site.
• <all_urls> (host_permissions) high Full cross-origin host access amplifies declarativeNetRequest to every URL.
• <all_urls> (content_scripts) high Content script injected on every page; can read/modify DOM on all sites.

Pillar Scores

Bookkeeping