Top Risks

• AI extension injects into GitHub/GitLab/Azure DevOps pages and sends PR diff content to developer-controlled cloud backend (thinkgpt.cloudfunctions.net).
• brand_mention.is_impersonation=true for GitHub and GitLab with no confirmed ownership; developer_name is empty.
• new Function(scriptText)() in honeybadger-service.js executes fetched remote script text — remote code execution vector.
• Multiple innerHTML sinks on AI-rendered content from PR pages create DOM-XSS risk in sensitive code-review context.
• install_url_hijack and uninstall_url_hijack both true; onboarding/goodbye pages on third-party domain.

Evidence

• function_constructor_remote_exec crx honeybadger-service.js fetches remote script text and executes via new Function(scriptText)() — effective remote code loading.
• brand_impersonation store brand_mention.is_impersonation=true for github/gitlab; confirmed_owner=false; developer_name empty.
• ai_page_content_processing manifest Extension injects into GitHub, GitLab, Azure DevOps pages and posts content to us-central1-thinkgpt.cloudfunctions.net.
• install_uninstall_url_hijack crx Both install and uninstall URLs redirect to thinkreview.dev — onboarding/goodbye tracking.
• dom_xss_sinks crx 5 innerHTML sinks across popup, formatting, integrated-review, agent-review-tabs, and test files.
• third_party_sharing_privacy_policy store Privacy policy confirms data_collection=true, third_party_sharing=true, retention=true; scoped to extension.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; partially offsets reputation risk.
• js_external_hosts_broad crx 12 distinct external hosts including openrouter.ai, cursor.com, oauth2.googleapis.com, portal.thinkreview.dev.

Permissions Breakdown

• storage low Local key-value storage; low risk in isolation.
• identity medium Can obtain OAuth tokens; risk depends on scopes requested at runtime.
• scripting medium Programmatic script injection into pages; medium risk paired with host_permissions.
• activeTab low Transient access to active tab only; low risk.
• host:https://gitlab.com/* high Full access to GitLab pages including PR diffs and tokens.
• host:https://github.com/* high Full access to GitHub pages including PR diffs and session cookies.
• host:https://patch-diff.githubusercontent.com/* medium Access to raw patch diffs on GitHub CDN.
• host:https://us-central1-thinkgpt.cloudfunctions.net/* high Developer-controlled cloud backend; PR diff data may be sent here.
• host:https://dev.azure.com/* high Full access to Azure DevOps pages including code and tokens.
• host:https://*.visualstudio.com/* high Wildcard access to all VisualStudio subdomains.

Pillar Scores

Bookkeeping