Top Risks

• Brand impersonation: extension name uses 'Instagram' without confirmed ownership; free-webmail developer.
• Shell pattern flagged: promises download but lacks 'downloads' permission — description-permission mismatch.
• Privacy policy admits data collection and third-party sharing without retention disclosure.
• ToS violation risk: media downloader scraping Instagram violates platform ToS (v3.1 rule 7).
• Developer is free-webmail (gmail) with no verified business identity, raising future-compromise risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer domain is gmail.com, not Meta/Instagram.
• description_promise_mismatch crx description_promise.mismatches: 'promises download but lacks downloads permission'; is_shell_pattern=true.
• privacy_policy_data_collection_third_party api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• tos_violation_media_downloader store MediaDownloader scraping instagram.com violates Instagram ToS (v3.1 rule 7).
• free_webmail_developer store Developer email divyaiprtp@gmail.com; no verified business website; no verified publisher badge.
• js_external_hosts crx 7 external hosts contacted: github.com, greasyfork.org, stackoverflow.com, google.com, instagram CDN — no CSP.
• maintenance_stale store 17 months since last update; 6-12mo band (+3.5) → capped at 6.0 after adjustment.
• no_cve_no_obfuscation crx cve_findings_raw empty; obfuscation_score=0.0; code_findings_raw empty — code quality low risk.

Permissions Breakdown

• host_permissions: https://www.instagram.com/* low Scoped to Instagram only; matches stated downloader function.
• content_scripts: https://www.instagram.com/* low Content script limited to Instagram; consistent with media download purpose.

Pillar Scores

Bookkeeping