Top Risks

• Uninstall URL hijack redirects to 10xprofit.io marketing page — monetization/tracking vector.
• Privacy policy admits data collection + third-party sharing but is not scoped to this extension.
• Amazon brand impersonation: developer domain is gmail.com, not amazon.com; confirmed_owner=false.
• Free-webmail Gmail developer email with no verified publisher badge raises accountability concerns.
• Geo-diversity: JS host spans 4 countries (CN, FR, IE, US) for a trivial keyword-cloud tool.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() → https://10xprofit.io/tools/?utm_source=chrome-extension (3rd-party marketing).
• brand_impersonation store brand_mention.is_impersonation=true; brands=['amazon']; developer_domain=gmail.com; confirmed_owner=false.
• privacy_policy_generic api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D-rule +10.0.
• free_webmail_developer store Developer email 10xprofitio@gmail.com; no verified publisher badge; no recognized org.
• install_url_hijack crx onInstalled opens welcome.html (internal); low independent risk but part of monetization cluster.
• host_geo_diversity crx JS hosts span CN, FR, IE, US (4 countries) for a simple keyword-cloud extension.
• no_csp manifest content_security_policy=null; MV3 strict default applies, partially mitigates but no explicit policy set.
• operator_cluster api sibling_count=0; fingerprint includes gmail+uninstall URL; isolated but identity signals weak.

Permissions Breakdown

• storage low Local key-value storage; no cross-origin data exposure on its own.
• *://*.amazon.*/*(host_permissions x22) medium Content-script access to all Amazon storefronts; scoped to stated function but broad multi-country reach.

Pillar Scores

Bookkeeping