Top Risks

• Privacy policy URL returned HTTP error (fetch_error) — cannot confirm adequacy; treated as missing.
• Developer uses free webmail (gmail) with no developer name, reducing accountability.
• install_url_hijack is true — onInstalled opens a URL, possibly to Gumroad for upsell.
• Extension contacts external hosts api.gumroad.com and mrviolets.gumroad.com (monetization/licensing check).
• No content security policy declared (MV3 default applies but no explicit hardening).

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false due to HTTPError; scored as +10.0 privacy pillar.
• install_url_hijack crx install_url_hijack=true; target null but Gumroad fingerprint suggests monetization redirect on install.
• gumroad_external_hosts crx js_external_hosts: api.gumroad.com, mrviolets.gumroad.com — licensing/payment calls, not ad-tech.
• free_webmail_no_dev_name store developer_email=violetsmyster@gmail.com, developer_name empty; reduces accountability.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; applied -3.0/-2.0 reputation discounts.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty; code quality benign.
• recently_updated store months_since_update=2; maintenance pillar 0.0.
• no_broad_host_permissions manifest host_permissions=[], content_scripts_matches=[]; narrow capability scope.

Permissions Breakdown

• scripting medium Can inject JS/CSS into active tab; scoped by activeTab so limited blast radius.
• activeTab low Access only to user-invoked tab; transient, low persistent risk.
• storage low Local data persistence only; no exfil vector on its own.
• declarativeContent low Page-state matching to show browser action; no content read.
• sidePanel low UI surface only; no data access.
• commands low Keyboard shortcut registration; no data access.
• contextMenus low Adds menu items; no data access.
• fontSettings low Reads/sets browser font settings; limited scope.

Pillar Scores

Bookkeeping