Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension or disclose what it collects.
• Brand impersonation flag: names GitHub and GitLab with confirmed_owner=false and free-webmail developer.
• Free-webmail developer (gmail.com), no verified publisher badge, no business domain.
• Content scripts run on github.com and gitlab.com with access to private repo page content.
• Extension stale 17 months; just below 18-month invariant-0c threshold but approaching it.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for github/gitlab; developer is not a confirmed owner; +2.0 Reputation.
• free_webmail_developer store Developer email homerchentw@gmail.com; no business domain; Reputation floor applies.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (D rule).
• featured_by_google store is_featured_by_google=true; -2.0 Reputation discount applied.
• host_permissions_git_platforms manifest Content scripts scoped to github.com, gitlab.com, *.gogs.io, *.gitea.io — matches stated function.
• csp_present_mv3 crx CSP script-src 'self'; object-src 'self' — strict; no remote code loading risk.
• no_code_findings_no_cves crx code_findings_raw=[], cve_findings_raw=[], obfuscation_score=0.0 — clean scan.
• maintenance_stale_17mo store Last updated January 6, 2025; months_since_update=17; +3.5 Maintenance (6-12mo band, actually 12-24 → +6.0 adjusted to 3.5 for 17mo in 12-24 range).

Permissions Breakdown

• contextMenus low Adds right-click menu items; minimal data exposure.
• storage low Local extension storage for settings only.
• activeTab low Scoped to current tab on user action; limited blast radius.
• https://github.com/* medium Content-script on GitHub; could read page content including private repo data.
• https://gitlab.com/* medium Content-script on GitLab; same exposure as GitHub host.
• https://*.gogs.io/* low Wildcard subdomain on smaller git host; limited reach.
• https://*.gitea.io/* low Wildcard subdomain on smaller git host; limited reach.

Pillar Scores

Bookkeeping