Top Risks

• Default search provider override routes all user queries to api.getclickcalmly.com with no user consent visibility.
• Privacy policy is only 90 chars, does not scope to this extension, and data_collection==false is unverifiable at that length.
• No developer name listed; identity accountability is limited to an email address.
• Privacy policy length of 90 chars is implausibly short — likely placeholder; third_party_silence adds further uncertainty.
• Extension has 30K installs with zero JS files — all functionality is delivered via search-provider override, limiting auditability.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider is_default=true; search_url points to api.getclickcalmly.com capturing all search queries.
• privacy_policy_too_short api Privacy policy fetched but only 90 chars; scope_extension=false, effectively a placeholder with no meaningful disclosure.
• no_developer_name store developer_name is empty; no verified publisher badge; identity limited to team@clickcalmly.com.
• third_party_silence api Privacy policy does not mention third-party data sharing (+1.0 privacy).
• zero_js_files crx js_file_count=0; extension is effectively a search-override shell with no auditable JS logic.
• no_cve_findings crx cve_findings_raw is empty; no known vulnerable libraries detected.
• recently_updated store months_since_update=2; maintenance risk is minimal.
• no_bad_host_hits api threat_intel.bad_host_hits and monetization_hits are empty; affiliate_hits empty.

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Sets itself as default search engine routing all queries to api.getclickcalmly.com; significant data capture surface.

Pillar Scores

Bookkeeping