Top Risks

• Brand impersonation flag: extension mentions 'google' but developer is not a verified Google entity.
• No developer name provided; accountability gap.
• Privacy policy fetched but retention policy not disclosed.
• No CSP declared (MV3 mitigates this partially but adds minor concern).
• Domain calendarcolor.com differs from developer domain humanquest.net — split identity.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; mentions 'google'; developer not verified publisher.
• no_developer_name store developer_name is empty string; only email ali@humanquest.net available.
• privacy_policy_retention_missing api Policy fetched, scope_extension=true, data_collection=false, but retention=false.
• featured_by_google store is_featured_by_google=true; follows recommended practices badge present.
• narrow_host_scope manifest content_scripts limited to https://calendar.google.com/*; no broad host access.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; js_external_hosts empty.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.
• developer_domain_resolves api humanquest.net resolves=true, looks_throwaway=false; no bad/affiliate/monetization hits.

Permissions Breakdown

• storage low Stores user color preferences locally; no cross-site access.
• content_scripts https://calendar.google.com/* low Narrowly scoped to Google Calendar only; matches stated function.

Pillar Scores

Bookkeeping