Top Risks

• Brand impersonation: extension name references 'Claude' (Anthropic) without confirmed ownership.
• Privacy policy fetched but only 58 chars, scope_extension=false — effectively a stub policy.
• new Function() constructor in content script running on claude.ai — dynamic code exec risk.
• innerHTML DOM sink with user-controlled input and no CSP — DOM-XSS vector on Claude sessions.
• Install and uninstall URL hijack flags set; 12 external hosts including Cloudflare Workers endpoints.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands=['google','claude']; confirmed_owner=false.
• stub_privacy_policy api Privacy policy fetched but length=58 chars, scope_extension=false, data_collection=false.
• function_constructor_code crx new Function() used in content.bundle.js against claude.ai page data.
• dom_xss_sink_no_csp crx innerHTML user-controlled sink in content.bundle.js; csp_present=false amplifies risk.
• install_uninstall_url_hijack store install_url_hijack=true and uninstall_url_hijack=true; targets not resolved.
• external_hosts crx 12 JS external hosts including aruchamyvikram.workers.dev endpoints and thinksolv.lemonsqueezy.com.
• identity_email_permission manifest identity.email requested; reads user Google account email address.
• no_csp_mv3 manifest content_security_policy=null; MV3 default applies but no explicit hardening declared.

Permissions Breakdown

• identity low OAuth identity flow; low scope alone, but combined with identity.email raises data exposure.
• identity.email medium Reads user's Google account email; unnecessary for PDF/Doc export if not personalizing.
• storage low Local extension storage; standard low-risk permission.
• downloads low Needed to save PDF/Word files; matches stated function.
• https://claude.ai/* medium Content script on claude.ai only; narrow but reads all Claude conversation content.

Pillar Scores

Bookkeeping