Top Risks

• AI Policy Governance extension embedded in Google Classroom processes student page content
• Brand impersonation flag: 'google' mentioned but developer unaffiliated (unverified owner)
• Install URL hijack signal: onInstalled opens external URL
• Domain is young (~325 days) education startup with limited track record

Evidence

• verified_publisher store Web Store verified publisher badge present; discount capped by invariant.
• brand_impersonation api brand_mention.is_impersonation=true; 'google' referenced, confirmed_owner=false.
• install_url_hijack crx install_url_hijack=true; onInstalled opens external URL (+2.0 webstore).
• host_scope manifest Hosts limited to Google Classroom + operator Netlify/Railway/own domains; no broad access.
• privacy_policy api Policy fetched, scoped to extension, discloses collection/retention/3rd-party sharing.
• code_findings crx code_findings_raw empty; obfuscation_score=0; CSP script-src 'self' present.
• cve_findings api cve_findings_raw empty; no bundled JS libraries detected.
• domain_age api trafficliteedu.com first cert 2025-12-05, ~325 days old, resolves, not throwaway.

Permissions Breakdown

• storage low Standard local persistence; minimal impact.
• identity low OAuth identity, no scopes declared.
• alarms low Scheduled tasks only.
• activeTab low Temporary access to active tab on user gesture.
• scripting medium Can inject/execute scripts into pages.
• tabs medium Can read tab URLs and metadata.
• notifications medium Can push notifications; host access present.
• windows low Window management, no content access.

Pillar Scores

Bookkeeping