Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer uses free webmail (gmail) with no registered business domain or developer name.
• innerHTML sink in popup.js with no CSP creates DOM-XSS risk if response data is attacker-influenced.
• Verified publisher + featured badge present but don't resolve privacy policy deficiency.
• Small install base (5K) with generic policy increases tail-risk if extension changes hands.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com; scope_extension=false, data_collection=true, third_party_sharing=true — generic Google policy, not extension-specific.
• developer_identity store developer_email=tdallstr@gmail.com, developer_name empty; free webmail, no business domain, no verified publisher.
• dom_xss_sink crx popup.js: innerHTML assigned from variable; no CSP present on MV3 extension to restrict exploitation.
• verified_and_featured store verified_publisher=true and is_featured_by_google=true; partially offsets identity risk.
• host_permissions_narrow manifest Host permissions scoped to googleapis.com and oauth2.googleapis.com only; consistent with calendar integration.
• cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• maintenance_current store last_updated June 11 2026; months_since_update=0; actively maintained.
• threat_intel_clean api bad_host_hits, affiliate_hits, monetization_hits all empty; no malicious infrastructure detected.

Permissions Breakdown

• identity low OAuth identity flow; low risk without broad scopes declared.
• storage low Local extension storage only.
• alarms low Scheduled callbacks; no data access.
• notifications low Show desktop notifications; no exfil path.
• https://www.googleapis.com/* low Scoped to Google APIs; matches calendar scheduling function.
• https://oauth2.googleapis.com/* low OAuth token exchange only; narrow and expected.

Pillar Scores

Bookkeeping