Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Snapmaster – Screenshot E [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension, data collection and 3rd-party sharing admitted.
• No developer identity: no name, no email, no verified publisher badge.
• scripting + <all_urls> enables script injection into every site the user visits.
• Description promises recording (tabCapture/desktopCapture) but permissions don't support it — permission/promise mismatch.

Evidence

• host_permissions_all_urls manifest <all_urls> combined with scripting permission allows reading/injecting into every page visited.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• no_developer_identity store developer_name and developer_email both empty; no verified_publisher badge; no business identity.
• description_promise_mismatch store Promises recording but lacks tabCapture/desktopCapture permissions.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit policy declared.
• maintenance_unknown store last_updated and months_since_update are null; maintenance score treated conservatively.
• no_code_findings crx code_findings_raw is empty; obfuscation_score 0.0; 4 JS files scanned — no malicious signals detected.
• no_cve_findings crx cve_findings_raw is empty; no known-vulnerable libraries bundled.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Snapmaster – Screenshot E [data-theft] + malext.io malicious_extension_sentry; score 5.47 -> 7.97 (+2.5 cap 2.5).

Permissions Breakdown

• activeTab low Scoped to current tab on user action; limited reach.
• storage low Local key-value storage; standard for saving editor state.
• scripting medium Allows programmatic script injection into pages; medium risk on its own.
• <all_urls> high Host permission grants access to content of every site visited.

Pillar Scores

Bookkeeping