Top Risks

• Gmail developer with no verified identity; privacy policy is generic Google account policy, not extension-scoped.
• Privacy policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — scores maximum privacy risk.
• scripting + *://*/* content_scripts allow arbitrary JS injection on every visited site.
• install_url_hijack=true: onInstalled triggers redirect (target null/unresolved).
• raw.githubusercontent.com in js_external_hosts — extension contacts GitHub raw for JS without CSP.

Evidence

• free_webmail_developer store Developer email sparshpipley@gmail.com; no business domain; unverified individual.
• generic_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• broad_host_access_scripting manifest host_permissions *://*/* + scripting + content_scripts <all_urls> — full page access everywhere.
• install_url_hijack crx install_url_hijack=true with null target; onInstalled opens unknown 3rd-party URL.
• external_raw_github_host crx raw.githubusercontent.com in js_external_hosts — fetches unversioned remote content.
• dom_xss_sink crx materialize.min.js uses innerHTML with variable input; no CSP to mitigate DOM-XSS.
• no_csp manifest content_security_policy is null — no script-src restrictions despite external host contacts.
• is_featured_by_google store Extension carries is_featured_by_google=true, providing modest trust signal.

Permissions Breakdown

• contextMenus low Standard UI integration; minimal risk.
• storage low Local preference storage; low risk.
• tabs medium Can read tab URLs and titles across browsing session.
• scripting high Combined with *://*/* host perm allows script injection on any site.
• notifications low Can send desktop notifications; limited abuse potential alone.
• alarms low Scheduling only; no direct data access.
• *://*/* high Broad host access — content scripts on every URL pairing with scripting.

Pillar Scores

Bookkeeping