Top Risks

• Brand impersonation: mentions 'github' with confirmed_owner=false and dev is unverified protonmail user.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to this extension at all.
• Broad host permissions (<all_urls> equivalent) paired with content scripts on every site and no CSP.
• DOM-XSS sink (innerHTML from user-controlled variable) in content_script.js with no CSP mitigations.
• Developer uses free webmail (protonmail) with no verified business identity; low install count with high-tier permissions.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer is not confirmed owner; dev email chatgptnexus@protonmail.com.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst case under v3.5 rule D.
• broad_host_permissions manifest host_permissions and content_scripts on file:///* + http://*/* + https://*/* — effectively <all_urls>.
• dom_xss_sink_no_csp crx innerHTML user-controlled in content_script.js; csp_present=false amplifies risk per v3 FIX B.
• free_webmail_developer store Developer email chatgptnexus@protonmail.com; no verified publisher; no business domain; protonmail dev.
• small_install_high_perm api install_perm_anomaly.small_install_high_perm=true; 74 installs with <all_urls>-equivalent permissions.
• external_host_github crx js_external_hosts includes github.com; consistent with GFM/markdown rendering but still external dependency.
• no_csp manifest content_security_policy=null on MV3 extension; amplifies DOM-XSS and code quality risk.

Permissions Breakdown

• storage low Stores extension settings locally; minimal risk.
• file:///* high Access to all local files on the filesystem — broad host access.
• http://*/* high Content script on all HTTP sites — broad host access.
• https://*/* high Content script on all HTTPS sites — broad host access.

Pillar Scores

Bookkeeping