Top Risks

• Brand impersonation flag: extension references 'GitHub' brand but developer is not confirmed owner (octotree.io).
• Privacy policy fetched but scope_extension==false and data_collection==false — policy does not address this extension specifically.
• No developer name listed in store; only email support@octotree.io provided.
• function_constructor (new Function) found in content.js; evaluated against runtime input risk.
• Uninstall URL hijack flag set true though target is null — warrants verification.

Evidence

• brand_impersonation_flag store brand_mention.is_impersonation=true for 'github'; confirmed_owner=false; developer domain octotree.io is separate entity.
• verified_publisher store verified_publisher=true; domain octotree.io resolves, not throwaway. Caps reputation discount per 0c rules.
• privacy_policy_scope_missing api Policy fetched (1592 chars); scope_extension=false, data_collection=false — generic policy not scoped to extension.
• function_constructor_code crx new Function() in content.js; appears to be globalThis polyfill pattern, not user-controlled input eval.
• no_csp manifest content_security_policy=null; MV3 has strict default so no v2 +2.0 penalty applies.
• uninstall_url_hijack crx uninstall_url_hijack=true but uninstall_url_target=null — signal present, target unresolvable.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• no_developer_name store developer_name is empty string; only email available. Adds +1.0 to reputation pillar.

Permissions Breakdown

• storage low Local data persistence; standard for settings/state.
• contextMenus low Adds right-click menu items; low impact.
• activeTab low Scoped to user-triggered tab interaction only.
• scripting medium Can inject scripts; scoped to github.com via content_scripts but still medium risk.
• host:https://api.github.com/* medium API access to GitHub; necessary for code tree functionality.
• host:https://www.octotree.io/* low Developer's own domain; expected for licensing/updates.

Pillar Scores

Bookkeeping