Top Risks

• Privacy policy is Google's generic account policy — does NOT scope to this extension; data practices undisclosed.
• Brand impersonation: extension name/function references Google Calendar but developer is unaffiliated.
• Content script runs on <all_urls> — reads every page the user visits despite minimal stated permissions.
• install_url_hijack flag set; extension opens a URL on install, destination target is null/unverified.
• No developer name listed; accountability gap for an extension touching all browsing context.

Evidence

• content_scripts_broad manifest content_scripts_matches: ['<all_urls>'] — script injected on every site despite only contextMenus+activeTab declared.
• privacy_policy_generic store Privacy policy URL is myaccount.google.com/privacypolicy — generic Google policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; confirmed_owner=false; developer is betteraiapps.com.
• install_url_hijack crx install_url_hijack=true, install_url_target=null. Opens URL on install; destination unknown.
• no_developer_name store developer_name is empty string; no 'Offered by' identity visible to users.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reduces reputation risk but does not negate privacy gap.
• js_external_hosts crx js_external_hosts: [localhost, www.text-to-cal.com]; no bad-host hits but contacts external domain.
• rating_low store Rating 3.4 with 4,000 installs; below-average satisfaction signal.

Permissions Breakdown

• contextMenus low Adds right-click menu items; minimal risk on its own.
• activeTab low Temporary access to current tab on user gesture; limited scope.
• content_scripts:<all_urls> high Content script injected on all URLs grants read/modify access to every page DOM.

Pillar Scores

Bookkeeping