Top Risks

• <all_urls> host_permissions + content_scripts inject into every site visited, enabling broad page-content access.
• AI extension: page content is processed/exported to AI agents — privacy policy admits data collection and third-party sharing.
• Privacy policy lacks retention disclosure despite admitting data collection and third-party sharing.
• Small install base (614) with HIGH permission tier — tail attack surface if extension is later compromised or sold.
• No CSP declared (MV3 mitigates somewhat, but increases code-quality risk surface).

Evidence

• host_permissions <all_urls> + content_scripts <all_urls> manifest Extension injects content scripts on every URL; broad page-content reach paired with AI export functionality.
• AI extension processing page content store Description explicitly states exporting structured change requests to AI coding assistants.
• privacy_policy third_party_sharing=true, retention=false api Policy scoped to extension, acknowledges data collection and 3rd-party sharing but omits retention period.
• install_perm_anomaly small_install_high_perm=true api 614 installs with <all_urls> host permission; tail attack surface if extension is acquired.
• no CSP manifest content_security_policy is null; MV3 provides defaults but no explicit hardening declared.
• developer domain resolves, not throwaway api markupextension.com resolves and looks_throwaway=false; no bad-host or affiliate hits.
• code_findings_raw empty, obfuscation_score=0.0 crx 8 JS files scanned, no suspicious patterns detected, no external JS hosts.
• cve_findings_raw empty crx No bundled vulnerable libraries detected.

Permissions Breakdown

• activeTab low Scoped to user-initiated action on current tab only.
• storage low Local data persistence; low standalone risk.
• tabs medium Can read tab URLs and metadata across all tabs.
• clipboardWrite low Write-only clipboard; cannot read user clipboard data.
• <all_urls> (host_permissions) high Content scripts injected on every site; broad reach for annotation AI use case.

Pillar Scores

Scoring History

Bookkeeping