Top Risks

• Privacy policy fetch failed (SSL error), no visibility into data handling
• Free Gmail developer account with no business verification
• Uninstall URL hijack present (chrome.runtime.setUninstallURL to 3rd party)
• 90K installs with unclear operator identity
• 6-month update gap raises maintenance concerns

Evidence

• privacy_policy_unreachable api Privacy policy URL fetch failed with SSL error, cannot verify data handling practices
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() detected, potentially redirects users on uninstall
• free_webmail_developer store Developer uses Gmail account with no business website or verification
• stale_update store Last updated 6 months ago, moderate staleness
• no_network_surface crx No external hosts, no content scripts, CSP properly configured
• no_cve_findings api No known CVEs in bundled JavaScript libraries
• clean_code_scan crx No obfuscation, no remote code loading, no exfiltration indicators detected
• featured_badge store Google Featured badge present, some trust signal despite other concerns

Permissions Breakdown

• storage low Standard storage permission, low risk surface
• contextMenus low Context menu access, minimal risk without host permissions

Pillar Scores

Bookkeeping