Top Risks

• Generic Google privacy policy used instead of extension-specific policy
• Last updated 15 months ago, approaching stale/zombie status
• innerHTML DOM-XSS sink present without CSP protection

Evidence

• privacy_policy_generic api Privacy policy is generic Google My Account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• maintenance_stale store 15 months since last update. No changelog visible. Approaching zombie extension status.
• dom_sink_no_csp crx innerHTML assignment from variable found in sketch.js; MV3 has no explicit CSP but strict defaults apply.
• network_hosts crx js_external_hosts: github.com, www.asciiworld.com. No bad-host or monetization hits.
• featured_by_google store Extension has 'Follows recommended practices' / featured badge.

Permissions Breakdown

• storage low Local storage for saving drawings. No host or sensitive API access.

Pillar Scores

Bookkeeping