Top Risks

• Install-URL hijack triggers external redirect upon installation
• Maintenance status unknown (no last_updated date available)
• DOM-XSS sink via innerHTML assignment in content script
• Privacy policy acknowledges third-party data sharing
• Developer identity limited to business domain contact only

Evidence

• permissions crx Minimal permission set: storage only; host access limited to sportswzrd.com and ESPN/Yahoo fantasy domains
• reputation store Verified publisher with business domain email (hello@sportswzrd.com); no free webmail; rating 4.5
• webstore crx Install URL hijack detected (install_url_hijack=true); low install count (7k) reduces blast radius
• privacy store Policy fetched and scoped to extension, but discloses data collection and third-party sharing
• code crx No obfuscation (score 0.0); single DOM-XSS finding (innerHTML assignment) in wzrdKit asset
• network crx No CSP defined; external hosts limited to fantasy APIs (ESPN, Yahoo) and standard CDNs; no bad-host hits
• maintenance store Last updated date unavailable (months_since_update=null); cannot confirm maintenance activity

Permissions Breakdown

• storage low Standard client-side storage for settings/user data; minimal security impact.

Pillar Scores

Bookkeeping