Top Risks

• Broad host access (<all_urls>) with cookies + webRequest grants deep visibility into all browsing.
• eval_user_input + function_constructor in background.js: dynamic code execution core to category but elevates risk.
• declarativeNetRequestWithHostAccess + scripting enable powerful request/script modification.
• 12M install base creates massive blast radius if extension is ever compromised or sold.
• eval findings suggest userscript engine internals — required for function but not noise-free.

Evidence

• permissions crx cookies+webRequest+webRequestBlocking+<all_urls>+declarativeNetRequestWithHostAccess+scripting; justified-broad discount applied (DeveloperTools).
• code_findings crx eval_user_input + 2x function_constructor in background/extension.js. Userscript engine pattern; +2.5 per v3 rules.
• obfuscation crx obfuscation_score=0.0, no minification detected.
• privacy_policy api Fetched, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true — all present, 0.0.
• reputation store Verified publisher + Google featured; dev email support@tampermonkey.net matches domain. Floor 2.0 per v2 0a.
• network crx 8 external hosts incl. own CDN, github, duckduckgo favicons; no monetization/affiliate/bad-host hits; 2 countries.
• webstore store 12M installs, rating 4.8, category DeveloperTools matches function; search_engine_count=2 but not NewTab category.
• maintenance store Updated 1 month ago; MV3; minimum_chrome_version 120 (current).

Permissions Breakdown

• notifications medium Notification permission with broad host access context.
• unlimitedStorage low Storage capacity elevation, no direct exfil capability.
• tabs medium Can read tab URLs and titles.
• idle low Idle detection only.
• webNavigation medium Navigation observation across sites.
• webRequest high Full request visibility; core to userscript injection function.
• webRequestBlocking high Can block/modify requests; needed for script manager.
• storage low Local storage access.
• contextMenus low Context menu additions only.
• chrome://favicon/ low Favicon access for UI display.
• clipboardWrite medium Can write to clipboard.
• cookies high Cookie read/write; paired with all_urls elevates risk.
• alarms low Scheduled task support.
• declarativeNetRequestWithHostAccess high Network modification with host access; matches userscript function.
• scripting medium Script injection capability; core function of userscript manager.
• userScripts medium User script registration; definitive for category.
• offscreen low Offscreen document support.

Pillar Scores

Bookkeeping