Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits broad data collection and 3rd-party sharing.
• Broad host permissions (*://*/* + <all_urls>) combined with scripting API allow reading/modifying every page visited.
• Developer is anonymous (no name, free Gmail address) with no business domain to verify identity.
• No content_security_policy (MV3 default stricter but CSP absent; js_external_hosts include jquery/sizzlejs CDNs referenced in manifest).
• Stale at 18 months — borderline maintenance threshold; tail-attack-surface flag raised for low-install/high-perm profile.

Evidence

• broad_host_permissions manifest host_permissions declare both *://*/* and <all_urls> alongside scripting — full page access on every site.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — scores +10.0.
• anonymous_developer store developer_name empty, developer_email is free Gmail; no business domain; +1.5 free-webmail rep penalty.
• no_csp manifest content_security_policy is null; js_external_hosts include github.com, jquery.com, jquery.org, sizzlejs.com.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; only 3,000 installs with HIGH-tier host permissions.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true — reputation discounts applied but capped due to stale 18mo.
• maintenance_stale store months_since_update=18; sits at boundary of 6-12mo (+3.5) bracket.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0; no malicious signals detected in JS scan.

Permissions Breakdown

• storage low Standard local storage for saving color picks/palettes.
• scripting medium Allows injecting scripts into pages; elevated when paired with <all_urls>.
• *://*/* high Broad host access covering all HTTP/HTTPS pages.
• <all_urls> high Redundant with *://*/* — covers all URLs including file/ftp.

Pillar Scores

Bookkeeping