Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Developer uses free Gmail with no verifiable business identity or domain.
• No CSP; innerHTML sink in popup.js is unguarded against DOM-XSS.
• 3 external JS hosts (cdn.jsdelivr.net, fonts.googleapis.com, fonts.gstatic.com) loaded without CSP restriction.
• Extremely low install count (5) with unverifiable developer identity raises tail-risk concern.

Evidence

• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_email_free_webmail store Developer email bitxiaozhang@gmail.com — free Gmail, no business domain.
• no_csp crx content_security_policy is null; extension loads external JS from 3 CDN domains without CSP guardrails.
• dom_xss_sink crx popup/popup.js assigns el.innerHTML from dataset variable — DOM-XSS risk without CSP.
• external_js_hosts crx Loads from cdn.jsdelivr.net, fonts.googleapis.com, fonts.gstatic.com — 3 distinct external domains.
• host_permissions_scoped manifest Host permissions limited to file:///* and *://*/*.md / *://*/*.markdown — matches stated function.
• no_bad_hosts_no_affiliates api threat_intel shows empty bad_host_hits, affiliate_hits, and monetization_hits.
• tiny_install_base store Only 5 installs; no ratings. Unverified developer, no operator cluster siblings.

Permissions Breakdown

• file:///* medium Access to local files; scoped to .md/.markdown files only, matching stated function.
• *://*/*.md medium Host access scoped narrowly to .md files; matches markdown preview function.
• *://*/*.markdown medium Host access scoped narrowly to .markdown files; matches stated function.

Pillar Scores

Bookkeeping