Top Risks

• Brand impersonation: uses 'Google Gemini' branding but developer is unverified gmail user with no affiliation.
• Uninstall URL hijack to sparklabstech.com — third-party tracking on removal.
• content_scripts on <all_urls> gives page-content access to every site despite low declared permissions.
• Privacy policy admits data collection and third-party sharing but omits retention; hosted on free Netlify subdomain.
• function_constructor (new Function) in bundled lib and innerHTML DOM-XSS sink increase exploit surface.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; mentions google+gemini; developer is pervezismailnagi@gmail.com, not Google.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL to sparklabstech.com — third-party monetization/tracking URL.
• content_scripts_all_urls manifest content_scripts_matches=["<all_urls>"] with no host_permissions; runs on every page.
• free_webmail_developer store Developer email is gmail.com; no verified publisher badge; domain_age_ct not queried.
• privacy_policy_third_party_sharing api policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• code_quality_function_constructor crx new Function() in libs/typewritter.js — dynamic code execution capability.
• js_external_hosts crx 6 external hosts: buymeacoffee.com, generativelanguage.googleapis.com, github.com, hertzen.com, sparklabstech.com.
• maintenance_stale store months_since_update=13 (6-24mo band); no changelog visible.

Permissions Breakdown

• contextMenus low Adds right-click menu items; minimal risk on its own.
• activeTab low Grants access to current tab only on user gesture; scoped.
• storage low Local key-value storage; no cross-origin data access.
• content_scripts <all_urls> high Injects scripts into every page; broad content access despite narrow declared permissions.

Pillar Scores

Bookkeeping