Top Risks

• <all_urls> host permission combined with content scripts on AI chat platforms enables reading all conversation data including sensitive prompts.
• Privacy policy is fetched but scope_extension=false and data_collection=false with only 481 chars — effectively a stub; third_party_silence adds +1.0.
• Brand impersonation (ChatGPT, Claude, Gemini, DeepSeek) by unverified gmail developer with no developer name listed.
• 8 innerHTML DOM-XSS sinks across content scripts on AI chat pages; CSP connect-src is wildcard (*), amplifying exfil risk.
• install_url_hijack=true: extension opens a third-party URL on install, a known monetization/tracking behavior.

Evidence

• <all_urls> host_permission despite targeted content_scripts manifest host_permissions includes <all_urls> giving full site read capability beyond the 19 listed AI-chat origins.
• Privacy policy stub (481 chars, scope_extension=false) api Policy fetched but does not scope to this extension, no data collection disclosure, third_party_silence=true.
• Brand impersonation store brand_mention.is_impersonation=true for claude/deepseek/gemini/chatgpt; developer is unverified gmail user with no name.
• install_url_hijack crx install_url_hijack=true; extension opens URL on install — tracking/monetization signal.
• CSP connect-src wildcard manifest connect-src * data: blob: filesystem: allows outbound connections to any host from extension pages.
• 8x innerHTML DOM-XSS sinks on AI chat content scripts crx innerHTML used with user-controlled variables in cocounsel.js, claude.js, renderer.js, shared.js, popup.js, options.js, pdfobject, helpers.js.
• Free webmail developer, no developer name store developer_email=neocrtxai@gmail.com; developer_name empty; no verified publisher badge.
• Yandex cloud API host permissions manifest host_permissions includes cloud-api.yandex.net, oauth.yandex.com, oauth.yandex.ru — Russian cloud access of note.

Permissions Breakdown

• storage low Standard local state persistence; low risk in isolation.
• downloads medium Can trigger file downloads to user's system; moderate risk.
• downloads.open medium Can auto-open downloaded files; potential for phishing via crafted files.
• identity medium Access to Chrome identity/OAuth tokens; risk if misused for auth flows.
• unlimitedStorage low Allows unlimited local storage; low direct harm potential.
• declarativeNetRequest medium Can block/redirect network requests; scoped but meaningful capability.
• activeTab low Grants access to active tab on user gesture only; limited scope.
• <all_urls> (host_permission) high Despite targeted content scripts, <all_urls> host permission grants read access to all sites.
• https://*.google.com/* (host_permission) high Broad access to all Google domains including Gmail, Drive, Search.
• https://*.amazonaws.com/* (host_permission) high Broad AWS endpoint access; could reach sensitive cloud APIs.
• https://api.notion.com/* (host_permission) medium Access to Notion API; could read/write user workspace data.
• https://cloud-api.yandex.net/* (host_permission) medium Russian cloud storage API access; notable data sovereignty concern.

Pillar Scores

Bookkeeping