Top Risks

• Abandoned: 39 months since last update, zombie extension with active installs.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• ChatGPT brand impersonation by unverified free-webmail developer (automatemylife00@gmail.com).
• Content script on <all_urls> paired with clipboardRead gives page-content + clipboard access on every site.
• Description promises download functionality but lacks 'downloads' permission — permission/promise mismatch.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'chatgpt' brand claimed by unverified gmail developer.
• generic_privacy_policy store Privacy URL is Google account policy (474988 chars); scope_extension=false, data_collection=true, third_party_sharing=true.
• zombie_extension store Last updated April 2023; months_since_update=39, far exceeds 36-month zombie threshold.
• free_webmail_dev_no_domain store Developer email automatemylife00@gmail.com; domain_age_ct not queried due to free webmail.
• content_script_all_urls manifest content_scripts_matches=["<all_urls>"] injects JS on every site the user visits.
• description_mismatch store Promises download functionality but 'downloads' permission absent per description_promise.mismatches.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension with content scripts.
• low_rating store Rating=3.0; low-confidence quality signal for a code-downloader tool.

Permissions Breakdown

• clipboardRead medium Can read clipboard contents; risk is moderate but no broad host access amplifies it.
• content_scripts <all_urls> high Content script runs on every page; combined with clipboardRead creates broad data-access surface.

Pillar Scores

Bookkeeping