Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension and admits data collection + third-party sharing (privacy pillar = 10).
• Brand-mention impersonation flag: extension name uses 'Twitter' brand without confirmed ownership.
• No CSP on MV3 extension; content scripts run on all Twitter/X pages with full DOM access.
• Privacy policy URL is a generic Google policy (scope_extension=false, data_collection=true, third_party_sharing=true) triggering maximum privacy score.
• installs >10K on a Twitter UI modifier with broad content-script access and inadequate privacy disclosure.

Evidence

• generic_google_privacy_policy store Privacy URL points to myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for 'twitter'; confirmed_owner=false; is_featured_by_google=true applies +1.0 rep penalty.
• is_featured_by_google store Extension carries Featured badge; applied -2.0 reputation discount.
• no_csp manifest content_security_policy=null on MV3; no CSP default hardening observable.
• content_scripts_twitter_scope manifest Content scripts scoped to twitter.com and x.com only; matches stated function — justified-broad discount applied to permissions.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty — no malicious indicators detected.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries bundled.
• maintenance_3_6_months store months_since_update=10 → 6-12mo band → +3.5 maintenance score.

Permissions Breakdown

• storage low Stores user preferences locally; no data exfil risk on its own.
• content_scripts: twitter.com, x.com, mobile variants medium Runs JS on all Twitter/X pages; scoped to stated function, but full DOM access on auth'd sessions.

Pillar Scores

Bookkeeping