Top Risks

• Developer identity unverifiable: free Gmail with no verified publisher badge
• 18 innerHTML sinks present, but strict MV3 CSP and static icons mitigate XSS
• Contacts 12 external hosts incl. Google Drive/Sheets — data flow needs monitoring
• Very low install base (175) limits field-testing and review scrutiny

Evidence

• permissions_moderate manifest scripting + 5 low-risk perms; single scoped host to Supabase
• reputation_weak store Gmail dev, not verified publisher, 175 installs, no siblings
• csp_strict crx MV3 CSP script-src 'self' 'wasm-unsafe-eval'; blocks remote code
• privacy_adequate api Scoped policy: collection, retention, and 3rd-party sharing disclosed
• code_innerhtml_only crx 18 dom_sink_innerhtml_userctrl hits; no eval/remote load; obfuscation 0
• network_multi_host crx 12 hosts incl supabase.co, weavy.ai, google.com, unsplash, github
• cve_clean crx cve_findings_raw empty; no bundled vulnerable libs detected
• maintenance_current store Updated Oct 2026, 0 months since update, MV3

Permissions Breakdown

• scripting medium Can inject/execute scripts on permitted hosts programmatically
• storage low Local extension storage only
• sidePanel low UI surface only, no host impact
• alarms low Scheduled tasks, low risk
• contextMenus low Context menu entries, low risk
• identity low Auth identity, no elevated scopes declared
• host:https://apmwtojjiljtpiyftknw.supabase.co/* low Single scoped host permission to developer's Supabase backend

Pillar Scores

Bookkeeping