Top Risks

• Brand impersonation: mentions 'gitlab' as brand, developer not confirmed owner, not verified publisher.
• Privacy policy is Google's generic account policy — scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy score.
• Broad host_permissions https://*/* with no CSP despite MV3 content scripts scoped only to GitLab MR paths.
• new Function() constructor found in JS — dynamic code execution risk without CSP guard.
• Small install count (48) with high-tier host permission flagged as anomaly by install_perm_anomaly.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'gitlab'; developer not confirmed owner, not verified publisher.
• generic_privacy_policy api Privacy policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_host_permissions manifest host_permissions=['https://*/*'] grants access to all HTTPS sites; no CSP present.
• function_constructor crx new Function() call found in assets/main.ts-knpFAJq3.js — dynamic code execution without CSP.
• install_perm_anomaly store small_install_high_perm=true: 48 installs with HIGH-tier host permission is a tail-risk pattern.
• external_js_hosts crx JS contacts github.com and marked.js.org externally; 2 countries (IN, US).
• no_csp manifest content_security_policy=null on MV3 extension with dynamic code execution finding.
• unverified_developer store verified_publisher=false; developer franckrst.com resolves but not verified; email is custom domain.

Permissions Breakdown

• https://*/* high Broad host access to all HTTPS sites; content_scripts scoped to GitLab MR paths but host_permissions is unrestricted.

Pillar Scores

Bookkeeping