Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (D rule: +10.0 privacy).
• Extension not updated in 26 months — abandoned or stale, unpatched risks accumulate.
• new Function() constructor present in 3 JS files (background, sidebar, newtab-app) — dynamic code execution risk.
• No CSP declared (MV3 exempts +2 network penalty, but function_constructor without CSP raises code quality concern).
• Developer uses free Gmail address with no verified publisher status and no resolvable business domain.

Evidence

• privacy_policy_generic store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (rule D).
• maintenance_stale store Last updated July 2024; 26 months since update → +8.5 maintenance score.
• function_constructor_x3 crx new Function() in background.js, content-sidebar.js, newtab-app.js → +2.5 code quality per rubric (debugger_attach/function_constructor class).
• external_js_hosts crx Loads from alpinejs.dev and chat.cloudapi.stream; 2 distinct external hosts, network risk moderate.
• free_webmail_dev store Developer email nashprom.info@gmail.com; free webmail, no verified publisher, no business website confirmed.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit restriction on function_constructor usage.
• low_installs store Only 27 installs; very low adoption reduces blast radius but also reduces scrutiny.
• operator_cluster_singleton api sibling_count=0; no known cluster, but gmail fingerprint and external chat host warrant attention.

Permissions Breakdown

• storage low Local data persistence; low risk in isolation.
• sidePanel low Renders UI in side panel; no host access implied.

Pillar Scores

Bookkeeping