Top Risks

• Privacy policy is Google's generic policy (not scoped to this extension), admits data collection and 3rd-party sharing — scores max privacy risk.
• Brand impersonation: uses WhatsApp branding without being a Meta-verified publisher.
• Content script on web.whatsapp.com with access to generativelanguage.googleapis.com (Gemini AI) — message content may be sent to AI API.
• function_constructor (new Function()) found in bundled JS — code execution risk without CSP.
• 12 external JS hosts including socket.io, github.com, and Google APIs — broad network surface for a WhatsApp utility.

Evidence

• privacy_policy_generic_google store Privacy URL points to myaccount.google.com/privacypolicy — Google's own policy, not scoped to Luma Conecta; admits data collection and 3rd-party sharing.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for WhatsApp; developer domain lumaconecta.com is not confirmed owner.
• ai_api_endpoint crx js_external_hosts includes generativelanguage.googleapis.com — Gemini API; extension has full WhatsApp Web access, risk of message exfil to AI.
• function_constructor_code_finding crx new Function() constructor found in v_7_4_3_78_...193.js; CSP is absent (csp_present=false), no mitigation.
• dom_sink_innerhtml crx innerHTML assignment from variable in v_7_4_3_78_...12.js; DOM-XSS sink with no CSP present.
• broad_external_hosts crx 12 distinct external hosts: socket.io, github.com, Google Workspace APIs, react.dev — high geo/network surface for a WhatsApp tool.
• unverified_small_install store Only 14 installs; not verified publisher, not featured; domain cert age 676 days but no track record.
• no_csp manifest content_security_policy is null; MV3 default helps but no explicit CSP leaves innerHTML and new Function() unmitigated.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data caching.
• storage low Standard key-value storage; low risk alone.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs and titles across sessions; moderate privacy surface.
• https://web.whatsapp.com/* high Full content-script and host access to WhatsApp Web; can read all messages and UI state.

Pillar Scores

Bookkeeping