Top Risks

• Privacy policy fetched but not scoped to this extension; admits data collection and third-party sharing — max privacy score triggered.
• Brand impersonation flag: title uses Google™ trademark but kamiapp.com is not a confirmed Google property.
• manifest_source is html_fallback — no permissions or code could be inspected; actual capability is unknown.
• 11M installs create large blast radius; any future compromise or policy change has wide impact.
• Not a verified publisher despite large user base; Google Featured badge partially offsets but does not eliminate risk.

Evidence

• brand_impersonation store Title contains 'Google™' but confirmed_owner==false; is_impersonation==true per brand_mention.
• privacy_policy_unscoped_with_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D clause: +10.0 privacy.
• manifest_html_fallback store manifest_source=html_fallback; js_files_scanned=0; permissions unknown — capability gate cannot be applied.
• is_featured_by_google store Google Featured badge present; partially offsets reputation risk.
• large_install_count store 11M installs; blast radius is high if extension is ever compromised or policy changes.
• no_bad_hosts_no_cves api threat_intel bad_host_hits=[], affiliate_hits=[], cve_findings_raw=[] — no active threat signals.
• recently_updated store months_since_update=0; maintenance risk is minimal.
• operator_cluster_clean api sibling_count=0; no cluster pattern detected.

Pillar Scores

Bookkeeping