Top Risks

• declarativeNetRequestWithHostAccess + <all_urls>: can intercept/modify all network traffic across every site.
• Privacy policy is Google's own policy (not scoped to this extension) and admits data collection + 3rd-party sharing.
• Free-webmail developer (gmail), no verified publisher, no business website — low accountability.
• Install-URL hijack: onInstalled opens a third-party URL, unsolicited redirect on installation.
• Content scripts injected on all URLs give full DOM read/write access to every page visited.

Evidence

• declarativeNetRequestWithHostAccess + <all_urls> manifest HIGH permission paired with broad host access; can block/redirect any network request on any site.
• Privacy policy is generic Google account policy store scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy disclosure.
• Free-webmail developer, no verified publisher store hunkiepeanut.dev@gmail.com, no badge, no business domain — minimal accountability.
• install_url_hijack=true crx Extension opens a URL on install via onInstalled; target not disclosed.
• js_external_hosts includes aim.cloudflare.com, speed.cloudflare.com crx External JS hosts present; Cloudflare endpoints suggest telemetry or CDN usage from a JSON viewer.
• No content_security_policy (MV3) manifest csp_present=false; MV3 has strict defaults but no explicit CSP declared.
• Zero installs, zero ratings store No user base to validate behavior; tail-attack surface concern.
• example.com and foo.bar in js_external_hosts crx Placeholder/test domains present in external host list — code quality or development artifact concern.

Permissions Breakdown

• storage low Stores local extension data; minimal risk.
• declarativeNetRequestWithHostAccess high Can intercept and modify network requests across all sites when paired with <all_urls>.
• <all_urls> (host_permissions) high Broad host access to every site the user visits; high capability reach.
• content_scripts <all_urls> high Content scripts injected into every page; can read/manipulate all page content.

Pillar Scores

Bookkeeping