Top Risks

• Privacy policy is Shopify's generic corporate policy — does not scope data handling to this extension.
• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing true: scores +10.0 per v3.5 rule D.
• content_scripts on <all_urls> grants broad page access despite low-permission manifest.
• new Function() constructor in speedscope demangler; no CSP to mitigate dynamic code execution.
• 17 months since last update; approaching stale threshold.

Evidence

• recognized_org_developer store Developer is Shopify (shopify.com resolves, confirmed_owner=true, not impersonation). Reputation floored at 2.0.
• privacy_policy_generic api Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• content_scripts_all_urls manifest content_scripts_matches=[<all_urls>] injects into every page; raises permissions despite low declared permissions[].
• function_constructor crx new Function() in speedscope/demangle-cpp.1768f4cc.js; dynamic code exec in bundled profiler lib.
• no_csp manifest content_security_policy=null; MV3 has strict default but no explicit CSP declared.
• maintenance_stale store 17 months since last update (Jan 2025); +6.0 maintenance pillar (12-24mo band).
• js_external_hosts crx Contacts api.shopify.com and feross.org; 2 distinct domains, both dev-controlled or known OSS.
• low_rating store Rating=2.0; rating_count unknown so +1.0 reputation rule not applied (threshold requires >=50 ratings).

Permissions Breakdown

• storage low Local data persistence; no cross-origin risk.
• identity low OAuth token access; scoped to user-initiated auth flows.
• activeTab low Tab access only on user interaction; narrow scope.
• content_scripts:<all_urls> high Content script runs on every page despite DeveloperTools category; broad reach.

Pillar Scores

Bookkeeping