Top Risks

• Privacy policy is Google's generic policy, not scoped to this extension; data_collection and third_party_sharing admitted without extension-level scope.
• Extension stale 27 months (>24 mo); no updates since March 2024.
• Brand impersonation flagged: GitLab mentioned as brand but developer is not a confirmed owner.
• Uninstall URL hijack detected; destination unknown.
• obfuscation_score 0.4 with hex-dense blobs in background and popup JS; no CSP to constrain execution.

Evidence

• privacy_policy_generic store Policy URL is Google myaccount generic policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for GitLab; developer not verified_publisher nor featured → +2.0 reputation.
• uninstall_url_hijack crx uninstall_url_hijack=true, target null. Webstore +3.0 per rubric monetization shell signal.
• stale_extension store months_since_update=27; falls in 24-36mo band → maintenance +8.5.
• obfuscation_hex_density crx obfuscation_score=0.4 (>=0.2 <0.5) in background.js and popup.js → code quality +1.0.
• dom_sink_innerhtml crx dom_sink_innerhtml_userctrl in popup.b4cecaee.js; csp_present=false → +2.0 code quality (FIX B).
• no_csp manifest content_security_policy=null; MV3 so no +2.0 network penalty, but amplifies code findings.
• operator_cluster_clean api sibling_count=0, no bad_host_hits, no monetization_hits, no affiliate_hits.

Permissions Breakdown

• storage low Stores local preferences; no cross-site data risk.
• alarms low Schedules periodic checks; minimal harm potential.
• unlimitedStorage low Extends storage quota; no data-exfil vector by itself.

Pillar Scores

Bookkeeping