Top Risks

• proxy permission lets developer route ALL browser traffic through skorostprdo.space, a single RU-hosted unknown server.
• Privacy policy is Google's own generic policy — not scoped to this extension; data collection/sharing terms completely opaque.
• Free-webmail dev (gmail), no developer name, no business website; identity entirely unverifiable.
• External JS host skorostprdo.space is an obscure .space domain with no transparency; install_url_hijack=true opens it on install.
• Only 95 installs with high-impact proxy permission — classic tail-attack-surface pattern with minimal accountability.

Evidence

• proxy_permission manifest proxy declared — all browser TCP traffic can be redirected to skorostprdo.space (RU-hosted).
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_no_devname store developer_email=maks.osokin2061@Gmail.com, developer_name empty, no business domain. Reputation floor triggered.
• install_url_hijack manifest install_url_hijack=true; extension opens 3rd-party page on install — monetization/redirect signal.
• external_js_host crx js_external_hosts: [skorostprdo.space] — unknown .space domain, single RU geo; all traffic routed here via proxy.
• small_install_high_perm api install_perm_anomaly: 95 installs + proxy (HIGH). small_install_high_perm=true.
• no_csp manifest csp_present=false on MV3; +2.0 network per v2 calibration fix (b) does not apply to MV3, but no CSP noted.
• cve_findings_empty crx No CVE findings detected; cve_pillar_score=0.0.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; critical for a VPN but extremely dangerous.
• storage low Local data persistence; low risk on its own.

Pillar Scores

Bookkeeping