Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing (v3.5 D: +10.0 privacy).
• brand_mention flags eBay impersonation (is_impersonation=true, not verified owner); extension is featured so +1.0 reputation.
• Content scripts injected across 38 eBay domains globally give broad read/write access to user auction sessions.
• Last updated 20 months ago — borderline stale; verified-publisher discount capped at -1.0 under invariant 0c (months>18).
• No developer name listed; privacy policy is a generic Google account policy URL with no extension-specific scope.

Evidence

• privacy_policy_generic_google store Privacy URL points to myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation_ebay store brand_mention.is_impersonation=true, confirmed_owner=false; extension injects into all eBay domains without eBay affiliation.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discount capped at -1.0 per invariant 0c (months_since_update=20>18).
• maintenance_stale store Last updated October 2024, 20 months ago — falls in 18-24mo range, scoring +6.0 maintenance pillar.
• no_csp manifest content_security_policy is null (MV3 default strict applies, no v2 penalty, but no explicit CSP hardening).
• content_scripts_ebay_global manifest content_scripts_matches covers 38 eBay TLD patterns (http+https) — runs JS on every eBay listing page globally.
• no_developer_name store developer_name is empty string; identity relies solely on email mysupport@myibidder.com and dev domain.
• clean_code_findings crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts limited to www.myibidder.com — no malicious signals.

Permissions Breakdown

• content_scripts on *.ebay.* medium Injects JS into all eBay storefronts globally; can read page content and inject UI elements.
• host_permissions: https://*.myibay.com/, https://*.myibidder.com/, https://*.myibay.net/ low Scoped to developer-owned domains only; used for bid-sniper backend calls.

Pillar Scores

Bookkeeping