Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• brand_mention flags GitHub impersonation by unverified individual developer (jwu1100@icloud.com).
• innerHTML DOM-XSS sink in background.js with no CSP; potential for XSS if content is attacker-controlled.
• Extension is 22 months stale (no update since Aug 2024); accumulating unpatched risk window.
• Developer email is free-webmail (iCloud) with no business domain; no verified publisher badge.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer not verified or featured → +2.0 reputation.
• dom_sink_innerhtml_userctrl crx background.js assigns bodyHtml to document.body.innerHTML with no CSP; DOM-XSS sink → +2.0 code quality.
• no_csp manifest content_security_policy is null (MV3 default strict, so no +2.0 network penalty, but worsens innerHTML risk).
• stale_extension store 22 months since last update → maintenance +6.0.
• free_webmail_dev store Developer email jwu1100@icloud.com is free-webmail; no business website; no verified publisher → reputation penalty.
• featured_by_google store is_featured_by_google=true → -2.0 reputation discount applied.
• no_bad_hosts_no_affiliates crx threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty; no external JS hosts.

Permissions Breakdown

• activeTab low Only accesses the active tab on user action; limited surface.
• scripting medium Can inject scripts into pages; combined with activeTab limits scope but still significant.
• contextMenus low Adds right-click menu items; low standalone risk.

Pillar Scores

Bookkeeping