Top Risks

• Uninstall URL hijack redirects to Google Forms — tracks user departures via 3rd-party service.
• Install URL hijack opens gazolin-production.com welcome page — tracks installs.
• Free-webmail dev (gmail) with no verified publisher or business identity; numbered alias email.
• Description promises recording but lacks tabCapture/desktopCapture — permission/promise mismatch.
• Privacy policy admits third-party sharing but no retention period disclosed.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL targets https://forms.gle/QrqeJkqHbk6uAjHD6 (3rd-party Google Forms).
• install_url_hijack manifest onInstalled opens https://gazolin-production.com/chromescreencapture/welcome — install tracking.
• free_webmail_dev store Developer email gazolinproduction2@gmail.com; numbered alias; no verified publisher badge.
• description_promise_mismatch store Extension promises recording but manifest lacks tabCapture or desktopCapture permissions.
• privacy_policy_third_party_sharing api Policy fetched, scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_csp manifest content_security_policy is null; MV3 provides default CSP so no v2 penalty applied.
• low_install_count store Only 764 installs; no ratings; very limited community signal.
• js_external_hosts crx External hosts: forms.gle, gazolin-production.com — both tied to install/uninstall hijacks.

Permissions Breakdown

• activeTab low Grants access to current tab only when user invokes extension; scoped and low-risk.
• scripting medium Allows injecting scripts into active tab; medium risk but limited by activeTab scope.
• clipboardWrite medium Can write to clipboard; expected for screenshot tool but allows silent clipboard manipulation.

Pillar Scores

Bookkeeping