Top Risks

• scripting + <all_urls>: can inject JS into any website and extract all page content universally.
• Privacy policy on unrelated Bitcoin faucet domain; admits third-party sharing, no retention terms.
• No developer name; free-webmail identity (live.in) with low accountability.
• 119 installs with high-tier permissions — tail-attack-surface risk if extension changes hands.
• No CSP declared; future code changes face no script-src guard.

Evidence

• scripting + <all_urls> manifest scripting permission with <all_urls> host access allows arbitrary JS injection on every site.
• privacy_policy_domain_mismatch store Privacy policy hosted on buyfreebitco.in — a Bitcoin faucet site, unrelated to content-copying tool.
• third_party_sharing admitted api privacy_policy_classification: third_party_sharing=true, retention=false; policy does not scope to this extension.
• no developer name store developer_name is empty; only identifier is sourabhnagori@live.in, a free webmail address.
• install_perm_anomaly api small_install_high_perm=true: 119 installs with HIGH-tier permissions (scripting+<all_urls>).
• no CSP manifest content_security_policy is null on MV3; no additional script restriction beyond manifest defaults.
• verified_publisher store Extension carries verified_publisher badge, partially mitigating reputation risk.
• cve_findings_raw empty crx No CVEs detected in bundled libraries; code_findings_raw also empty, obfuscation_score=0.0.

Permissions Breakdown

• activeTab low Scoped to current tab on user action; limited blast radius.
• scripting high Allows JS injection into pages; combined with <all_urls> this is broad code execution.
• clipboardWrite medium Can write arbitrary content to clipboard; matches stated copy function but abusable.
• tabs medium Can read tab URLs and titles across all open tabs.
• <all_urls> high Host permission covering every site; paired with scripting enables universal content extraction.

Pillar Scores

Bookkeeping