Top Risks

• Extension last updated 38 months ago — effectively abandoned, zombie risk (MV2, no CSP).
• Privacy policy is a generic Google Sites page: admits data collection and 3rd-party sharing, not scoped to this extension.
• Developer uses free webmail (gmail) with no verified business identity.
• MV2 with no content_security_policy — remote-code injection surface not mitigated by manifest.
• Very low install base (175) makes future malicious transfer low-cost and low-visibility.

Evidence

• maintenance_stale store Last updated June 2023, 38 months ago. Triggers zombie-booster tier (>36mo).
• privacy_policy_generic_admits_sharing api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• free_webmail_developer store Dev email marrijeen1214@gmail.com with no business website. Reputation floor applies.
• no_csp_mv2 manifest content_security_policy is null on MV2 extension → +2.0 Network per v2 calibration fix (b).
• js_external_hosts crx Contacts api.trello.com and trello.com — consistent with stated function; no bad-host hits.
• no_cve_findings api cve_findings_raw is empty; no library CVEs detected.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; no malicious code patterns found.
• low_installs_unverified store Only 175 installs, unverified publisher, free-webmail dev — low acquisition cost for hostile takeover.

Permissions Breakdown

• activeTab low Grants access to current tab only on user action; limited scope.
• contextMenus low Adds right-click menu items; no data access on its own.

Pillar Scores

Bookkeeping