Top Risks

• Privacy policy fetched but scope_extension=false AND third_party_sharing=true with no retention disclosure — scores max privacy risk.
• Content script runs on *://*/* giving DOM read access across all sites; no CSP present amplifies innerHTML XSS risk.
• 4 innerHTML-userctrl sinks with no CSP — DOM-XSS exploitable if any injected text is attacker-controlled.
• Install URL hijacks to hivemoderation.com on extension install (+2.0 Webstore).
• 17 months since last update with verified publisher discount capped at -1.0 per invariant 0c (stale >18mo threshold close; monetization hit applies).

Evidence

• verified_publisher+featured store Extension is verified publisher and featured by Google; reputation discount capped at -1.0 due to monetization_hits (invariant 0c v3.5E).
• privacy_policy_scope_fail api Policy fetched; scope_extension=false, data_collection=false, third_party_sharing=true → +10.0 privacy (v3.5D generic-policy hardening).
• install_url_hijack crx onInstalled opens hivemoderation.com/ai-generated-content-detection/installation-complete → +2.0 Webstore.
• dom_sink_innerhtml_no_csp crx 4 innerHTML sinks, csp_present=false → +2.0 code quality (FIX B: no CSP + innerHTML findings).
• content_scripts_broad manifest content_scripts_matches=[*://*/*] runs on all HTTP/HTTPS pages.
• monetization_hit api Google Analytics hit (telemetry tier only) → +1.0 Webstore.
• maintenance_stale store 17 months since update → +6.0 maintenance (6-12mo band; actually 17mo falls in 12-24mo → +6.0).
• no_csp_mv3 manifest content_security_policy is null; MV3 has strict default so no +2.0 network penalty, but amplifies code findings.

Permissions Breakdown

• contextMenus low Adds right-click menu items; no data access.
• storage low Local key-value store; no cross-origin risk.
• content_scripts *://*/* medium Runs on all pages; can read DOM of every site visited.

Pillar Scores

Scoring History

Bookkeeping