Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Developer uses free webmail (hotmail.com) with no verifiable business identity; username 'wandakeefer83' is opaque.
• No CSP declared; external JS loaded from cdnjs.cloudflare.com and markerjs.com creates remote-code risk surface.
• Description promises recording functionality but lacks tabCapture/desktopCapture — permission/description mismatch.
• Content scripts injected on all URLs (<all_urls>, file://, ftp://) gives broad page-read capability across every site.

Evidence

• privacy_policy_generic store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• developer_free_webmail store scrn.me@hotmail.com is a free-webmail address; no verified business website; Reputation floor 7.5 applied.
• no_csp manifest content_security_policy is null on MV3; no CSP protection; external hosts cdnjs.cloudflare.com and markerjs.com in js_external_hosts.
• description_mismatch store description_promise mismatch: promises recording but lacks tabCapture/desktopCapture. +2.0 Webstore.
• host_permissions_broad manifest <all_urls> host permission with content_scripts on *://*/* — broad but category-justified (Screenshot). Discount applied.
• install_count_signal store 10,000 installs; +1.0 Webstore for install reach.
• no_bad_hosts_no_cves crx bad_host_hits=[], affiliate_hits=[], monetization_hits=[], cve_findings_raw=[] — no active threat signals detected.
• obfuscation_clean crx obfuscation_score=0.0, code_findings_raw=[] — no obfuscation or malicious code patterns found.

Permissions Breakdown

• scripting medium Can inject JS into pages; paired with <all_urls> elevates risk but expected for screenshot tool.
• storage low Standard local data persistence.
• unlimitedStorage low Allows large local storage; plausible for screenshot/annotation data.
• <all_urls> (host_permission) high Broad host access; content scripts run on all pages. Justified-broad discount applies for Screenshot category.

Pillar Scores

Bookkeeping