Top Risks

• Privacy policy URL is unreachable (fetch_error); effective no-policy state scores maximum privacy risk.
• Extension is 31 months stale with only 9 installs; no accountability or update path.
• No developer name listed; gmail-based dev email with no verified business identity.
• Default search provider override silently routes all user queries through author.pics.
• Free-webmail developer identity with no verifiable business presence raises accountability concerns.

Evidence

• search_provider_override manifest chrome_settings_overrides sets author.pics as default search engine (is_default=true); all queries redirected.
• privacy_policy_fetch_failure api privacy_policy_classification.fetched=false (ConnectionError); policy URL unreachable — treated as no policy.
• stale_extension store Last updated January 2024; 31 months since update with only 9 installs.
• free_webmail_dev store Developer email darkmodemaster.com@gmail.com is a gmail account; no developer name provided.
• no_js_files crx js_file_count=0; no code surface to scan — extension is purely manifest-driven search override.
• no_bad_hosts api threat_intel.bad_host_hits empty; no monetization or affiliate hits detected.
• operator_cluster api sibling_count=0; no related extensions under same fingerprint.
• cve_clean crx cve_findings_raw empty; no bundled JS libraries detected.

Permissions Breakdown

• *://*.author.pics/* low Scoped only to dev's own domain; consistent with search provider function.
• chrome_settings_overrides.search_provider (is_default=true) medium Sets author.pics as default search engine; silently redirects all user queries.

Pillar Scores

Bookkeeping