Top Risks

• Privacy policy fetched but scoped to hostingchecker.net, not this extension; admits data collection and third-party sharing (→ Privacy +10.0).
• No developer name listed in store; reduces accountability.
• Privacy policy hosted on different domain (hostingchecker.net) than dev domain (amazingalgorithms.com); scope mismatch.
• description_promise mismatch: claims 'record' but lacks tabCapture/desktopCapture (likely false positive on keyword 'record').
• Very low install count (10) means no community trust signal; unproven extension.

Evidence

• privacy_policy_scope_mismatch api Policy at hostingchecker.net; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• verified_publisher store verified_publisher=true; applied -3.0 to Reputation pillar base.
• csp_absent_mv3 manifest MV3 extension; no CSP declared but MV3 has strict defaults — no +2.0 MV2 penalty applies.
• host_permissions_scoped manifest Only https://dns.google/* declared; matches DNS lookup stated purpose.
• js_external_hosts crx Contacts dns.google and hostingchecker.net; both low-risk, 1 country (US).
• code_findings_clean crx code_findings_raw empty, obfuscation_score=0.0; no malicious indicators found.
• description_promise_mismatch store promises.record=true but no tabCapture/desktopCapture; likely keyword false-positive on 'DNS record'.

Permissions Breakdown

• activeTab low Grants access to current tab only on user action; low passive risk.
• tabs medium Allows reading tab URLs/titles; moderate sensitivity but no broad host access.
• https://dns.google/* low Scoped host permission to Google DNS API; matches stated DNS lookup function.

Pillar Scores

Bookkeeping