Top Risks

• Brand impersonation: extension named 'GitHub helper' by unverified gmail.com dev with no confirmed ownership of GitHub brand.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Extension last updated Oct 2022 (~30 months ago); effectively abandoned.
• No CSP (MV3 default applies but no explicit policy); content script runs on github.com issue pages.
• Free-webmail developer with no business identity; accountability near-zero.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer is doclesha1@gmail.com, confirmed_owner=false.
• privacy_policy_generic store Policy is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• stale_extension store Last updated October 14, 2022; ~30 months since update → maintenance +8.5.
• free_webmail_dev manifest Developer email doclesha1@gmail.com; no business domain; reputation floor applied at 7.5.
• no_csp crx content_security_policy is null; MV3 default applies (no MV2 +2.0 penalty), but no explicit CSP.
• content_script_scope manifest Content script limited to https://github.com/*/issues/* — narrow scope, low direct capability risk.
• very_low_install_count store Only 7 installs; low blast radius but also no community vetting signal.
• no_bad_hosts_or_cves crx cve_findings_raw=[], bad_host_hits=[], code_findings_raw=[] — no active malicious signals detected.

Permissions Breakdown

• content_scripts: https://github.com/*/issues/* medium Injects script into GitHub issue pages; narrow scope but still DOM access on a sensitive platform.

Pillar Scores

Bookkeeping