Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing (score 10.0).
• manifest_source is html_fallback: no CRX permissions were extractable, leaving capability surface unverifiable.
• Developer name field is empty; identity relies solely on armin.dev email domain.
• Install count 400K raises blast-radius if extension were ever compromised or sold.
• Domain age via CT logs not confirmed (query error); armin.dev cannot be fully vetted.

Evidence

• privacy_policy_generic store Policy URL points to Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.0.
• verified_publisher store Extension carries verified-publisher badge; Reputation discount -3.0 applied (floor 2.0).
• featured_by_google store Extension is featured by Google; Reputation discount -2.0 applied in addition to verified-publisher.
• manifest_source_html_fallback store manifest_source=html_fallback; no permissions extracted. Install count 400K but no observable permission surface — v3.5(B) check: <100K threshold not met, no bonus.
• no_code_findings crx js_files_scanned=0, code_findings_raw empty, obfuscation_score=0.0; code quality score 0.0.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; developer domain resolves and not throwaway.
• no_cve_findings crx cve_findings_raw empty; CVE pillar 0.0.
• developer_name_missing store developer_name field empty; identity anchored only to cws@armin.dev.

Pillar Scores

Bookkeeping