Top Risks

• declarativeNetRequestWithHostAccess + <all_urls>: can silently intercept/redirect every HTTP request across all sites.
• Content scripts injected into every page combined with broad host access enables DOM reading/manipulation at scale.
• Privacy policy is Google's own account policy — wholly unscoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no verified publisher, no business website — unaccountable identity.
• install_url_hijack detected: extension opens a URL on install to an unverifiable target.

Evidence

• declarativeNetRequestWithHostAccess + <all_urls> manifest HIGH capability to block/redirect any request on any site; disproportionate for tab-snooze function.
• content_scripts_matches=<all_urls> manifest Scripts injected into every page the user visits — broad DOM access with no scoping.
• install_url_hijack=true manifest onInstalled opens external URL; target unknown.
• privacy_policy_classification crx Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true — D rule applies → +10.0.
• developer_email=hunkiepeanut.dev@gmail.com store Free webmail, no verified publisher, no business domain — reputation floor applies.
• js_external_hosts includes foo.bar and example.com crx Suspicious/placeholder hosts contacted; aim.cloudflare.com and speed.cloudflare.com are non-standard Cloudflare endpoints.
• csp_present=false (MV3) manifest No explicit CSP; MV3 provides defaults but no additional penalty per rubric.
• no install_count store Install count missing — blast radius unknown; no social proof.

Permissions Breakdown

• alarms low Core function: schedule tab re-open events.
• storage low Stores snooze schedules locally.
• contextMenus low Adds right-click snooze option.
• tabs medium Can read URLs and titles of all open tabs.
• declarativeNetRequestWithHostAccess high Can intercept/redirect network requests on all URLs; very broad for a tab scheduler.
• <all_urls> (host) high Full host access across every site; combined with declarativeNetRequestWithHostAccess is critical.
• <all_urls> (content_scripts) high Content scripts injected into every page — can read/modify DOM on any site.

Pillar Scores

Bookkeeping