Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension, admits data collection and 3rd-party sharing (score +10.0).
• Extension is ~11 months since last update; moderate staleness risk.
• No CSP defined (MV3 strict default applies, but absence still noted).
• Developer has no verified publisher badge and no 'Offered by' display name.
• 30K installs with YouTube content script; any future compromise has moderate reach.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• permissions_low manifest Only storage and alarms declared; content_scripts narrow to YouTube watch/embed URLs.
• no_cve_findings crx cve_findings_raw is empty; no vulnerable bundled libraries detected.
• no_code_findings crx code_findings_raw is empty; obfuscation_score=0.0; no exfil or eval patterns.
• maintenance_staleness store Last updated August 2024; ~11 months ago → +3.5 maintenance pillar.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; developer domain resolves.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; reputation starts at 5.0.
• install_count store 30,000 installs; >10K threshold adds +1.0 webstore signal.

Permissions Breakdown

• storage low Stores video resume positions locally; expected for this use case.
• alarms low Scheduling local wake events; no exfil surface.
• content_scripts: youtube.com low Narrow host scope limited to YouTube watch and embed URLs only.

Pillar Scores

Bookkeeping