Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension at all.
• Developer email is a personal iCloud address with no verified business identity.
• No CSP declared (MV3 provides strict default, mitigating but worth noting).
• Extension loads vuejs.org as external JS host — minor supply-chain surface.
• Featured badge partially offsets reputation concerns but does not resolve policy gap.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to this extension.
• developer_email_icloud store Developer email yohan_quinquis@icloud.com is personal free-webmail; no business domain or verified publisher badge.
• featured_by_google store Extension carries is_featured_by_google=true, indicating Google review — reduces reputation risk.
• no_host_permissions manifest Only permission is 'storage'; no host_permissions or content_scripts — minimal capability surface.
• external_js_host crx js_external_hosts includes vuejs.org; Vue 3.5.22 bundled inline, no CVEs detected.
• no_cve_findings crx cve_findings_raw is empty; no known vulnerable library versions detected.
• no_code_findings crx code_findings_raw is empty; obfuscation_score=0.0; no eval, exfil, or redirect signals.
• operator_cluster_clean api sibling_count=0; no related extensions under same fingerprint; no bad/monetization/affiliate host hits.

Permissions Breakdown

• storage low Stores local task data; no network or host access.

Pillar Scores

Bookkeeping