Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, admits 3rd-party sharing) — does not cover this extension at all.
• Brand impersonation: mentions 'github' in title/name, developer is unverified gmail user with no business identity.
• Developer identity weak: gmail address, no developer name, no business domain — low accountability.
• Content script on all github.com pages with innerHTML DOM-XSS sink could be exploited if GitHub content is attacker-controlled.
• 8 external JS hosts contacted (eligrey.com, stuartk.com, stuk.github.io etc.) — moderate supply-chain surface for a simple downloader.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=['github']; developer_domain=gmail.com; confirmed_owner=false.
• generic_privacy_policy store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — v3.5 rule D: +10.0.
• free_webmail_developer manifest developer_email=miecowbai@gmail.com; developer_name empty; no business domain verifiable.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in main.b7f29431.js; CSP present (MV3) so base penalty +0.5 applies.
• external_hosts crx 8 distinct JS external hosts: api.github.com, eligrey.com, github.com, purl.eligrey.com, raw.github.com, reactjs.org, stuartk.com, stuk.github.io.
• description_mismatch store description_promise mismatch: promises download but lacks 'downloads' permission.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; discounts applied but capped due to gmail dev domain.
• no_cve_findings crx cve_findings_raw is empty; CVE pillar = 0.00.

Permissions Breakdown

• storage low Stores local extension state only; no cross-origin risk.
• contextMenus low Adds right-click menu items; no data exfil capability alone.
• host_permissions: https://api.github.com/* medium Scoped to GitHub API; required for download function but allows reading GitHub API responses.
• content_scripts: *://github.com/* medium Runs JS on all GitHub pages; can read DOM including repo content and tokens visible on page.
• content_scripts: *://gitzip.org/gettoken/success low Narrow OAuth callback URL; scoped to own service.
• content_scripts: *://kinolien.github.io/gitzip/* low Narrow legacy domain; scoped to developer-controlled page.

Pillar Scores

Bookkeeping