Top Risks

• Privacy policy fetched but scope_extension==false and third_party_sharing==true — policy does not scope data practices to THIS extension.
• manifest_source is html_fallback with 200K installs — actual permissions and code surface completely unverifiable.
• No developer_name listed in store; verified_publisher badge absent despite a recognized brand.
• Rating 3.8 below threshold; nightly build channel may reflect instability rather than malice.
• Domain-age and wayback checks timed out — ownership transfer and cert history unverifiable.

Evidence

• manifest_source_html_fallback_high_installs store manifest_source==html_fallback with 200K installs; CRX not scanned — permissions, code, and libraries unverifiable.
• privacy_policy_scope_mismatch store Policy fetched (201KB), scope_extension=false, data_collection=true, third_party_sharing=true — generic corporate policy, not extension-scoped.
• no_developer_name store developer_name is empty string; not a verified publisher despite 1password.com domain resolving.
• is_featured_by_google store Extension carries Google Featured badge, providing partial trust signal.
• no_bad_hosts_no_monetization api threat_intel shows no bad_host_hits, no monetization_hits, no affiliate_hits; domain resolves and not throwaway.
• no_cve_findings crx cve_findings_raw empty; js_files_scanned=0 due to html_fallback — absence not confirmatory.
• recently_updated store months_since_update=0; last updated July 16 2026 — maintenance risk negligible.
• wayback_domain_age_timeout api wayback_ownership and domain_age_ct both timed out — ownership transfer and cert history unverifiable.

Permissions Breakdown

• manifest_source:html_fallback medium No CRX available; permissions inferred from store listing only — actual grants unknown.

Pillar Scores

Bookkeeping