Top Risks

• Brand impersonation: claims Gemini branding but dev is unaffiliated gmail user TriangleSnake
• Privacy policy is Google's generic myaccount policy — not scoped to this extension, admits data collection and 3rd-party sharing
• Free-webmail developer (gmail) with no verified business identity increases supply-chain / account-takeover risk
• AI-category extension with impersonation pattern could be used to harvest credentials or prompt-inject users
• Low install count with AI/Gemini branding is a common social-engineering distribution vector

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false; dev email is trianglesnake2002@gmail.com, not Google.
• free_webmail_developer store Developer email trianglesnake2002@gmail.com is free webmail with no associated business domain.
• generic_privacy_policy store Privacy URL is Google myaccount policy: scope_extension=false, data_collection=true, third_party_sharing=true.
• ai_extension_impersonation store Extension claims to interact with Gemini (Google AI) but is not published by Google; 10K installs reach is notable.
• no_permissions_declared manifest permissions=[], host_permissions=[], content_scripts=[]; minimal observable attack surface but also minimal stated function.
• maintenance_3_6_months store months_since_update=9; falls in 6-12 month band (+3.5).
• no_csp manifest content_security_policy=null; MV3 strict default applies so no network penalty, but no explicit CSP declared.
• low_rating store Rating=3.0; rating_count unknown, cannot apply >=50 threshold rule.

Pillar Scores

Bookkeeping