Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension at all, admits data collection and 3rd-party sharing.
• Brand impersonation flag: extension mentions 'github' brand, developer domain is gmail.com and not a confirmed GitHub partner.
• Free-webmail developer (gmail.com) with no business website raises accountability concerns.
• 19 months since last update — stale, no active maintenance signals.
• No CSP declared (MV3 so no +2.0 network penalty, but scripting+no-CSP leaves DOM risk open).

Evidence

• privacy_policy_generic store Privacy policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• brand_impersonation store brand_mention.is_impersonation=true for 'github'; dev domain is gmail.com, not verified publisher or featured.
• free_webmail_developer store Developer email chuanqi.sun.dev@gmail.com; no business website; reputation floor applies.
• stale_extension store Last updated Nov 2024, 19 months ago → maintenance +6.0 (12-24mo band).
• is_featured_by_google store is_featured_by_google=true; provides partial reputation offset (-2.0 featured badge).
• no_csp manifest content_security_policy is null; MV3 so no network +2.0, but no CSP hardening present.
• github_api_network crx js_external_hosts: api.github.com, github.com — matches stated GitHub-backend function; 2 distinct domains.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, cve_findings_raw empty — no malicious indicators.

Permissions Breakdown

• activeTab low Access limited to current active tab only on user gesture.
• storage low Local storage for bookmarks/state; standard low-risk permission.
• scripting medium Can inject scripts into pages; scoped to activeTab limits blast radius.

Pillar Scores

Bookkeeping