Top Risks

• nativeMessaging with unrecognized publisher allows arbitrary local code execution via companion app.
• Content scripts injected on <all_urls> gives broad DOM access across every site the user visits.
• Privacy policy is Google's generic account policy — does not scope data collection to this extension at all.
• Developer uses free Gmail address with no business identity; is_featured flag is only partial mitigation.
• Install-URL hijack opens a local helper page on install; uninstall URL hijack also flagged.

Evidence

• nativeMessaging_unrecognized_publisher manifest has_native_messaging=true, publisher_recognized=false — +3.0 permissions per rule 15.
• content_scripts_all_urls manifest content_scripts_matches=["<all_urls>"] — high-capability DOM access on every page visited.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• install_url_hijack crx install_url_hijack=true targeting /data/helper/index.html; also uninstall_url_hijack=true — webstore +2.0 (install) + +3.0 (uninstall).
• free_webmail_developer store developer_email=rynu.smith@gmail.com; no business website; +1.5 reputation free-webmail rule.
• js_external_hosts crx Contacts api.github.com, github.com, www.masswerk.at, www.youtube.com — 4 distinct registrable domains, no CSP.
• no_csp_mv3 manifest csp_present=false on MV3; no v2 network penalty but 4 external hosts still trigger +1.5 network.
• featured_by_google store is_featured_by_google=true — applies -2.0 reputation discount (featured badge).

Permissions Breakdown

• storage low Stores local settings; minimal risk.
• contextMenus low Adds right-click menu entry; low risk.
• notifications low Can display notifications; low risk.
• nativeMessaging high Communicates with local app; unrecognized publisher amplifies risk significantly.
• downloads medium Can initiate or intercept downloads.
• activeTab low Accesses current tab on user action only.
• alarms low Schedules callbacks; low risk in isolation.
• content_scripts:<all_urls> high Content script on all URLs — broad page-level access across every site visited.

Pillar Scores

Bookkeeping