Top Risks

• Claude brand impersonation by unverified gmail developer with no business presence.
• Privacy policy hosted on free Vercel subdomain; no data retention disclosure; third-party sharing undisclosed.
• Extension is 20 months stale with no verified publisher and a 2.9 rating.
• Content script on claude.ai can read full conversation history and session tokens.
• Developer identity unverifiable: free webmail, no business domain, no verified publisher badge.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[claude], confirmed_owner=false, dev domain=gmail.com.
• free_webmail_developer store Developer email pureugong@gmail.com; no business website; unverifiable identity.
• privacy_policy_on_free_hosting api Policy URL on make-meal-kits.vercel.app (free hosting); retention=false; third_party_silence=true.
• stale_extension store Last updated October 31, 2024; 20 months since update; no changelog visible.
• low_rating store Rating 2.9 with installs=785; no verified publisher badge.
• content_script_claude_ai manifest Content script injected on https://claude.ai/*; host permission also covers https://api.claude.ai/*.
• no_csp manifest content_security_policy is null; MV3 so no v2 network penalty, but no CSP is noted.
• code_findings_clean crx code_findings_raw empty; obfuscation_score=0.0; single JS file scanned.

Permissions Breakdown

• storage low Used to persist search history/settings locally; low standalone risk.
• host: https://claude.ai/* medium Content script injected into claude.ai; can read/modify Claude session content.
• host: https://api.claude.ai/* medium API endpoint access; could observe API responses including conversation data.

Pillar Scores

Bookkeeping