Top Risks

• 17 months since last update indicates potential abandonment
• Broad host permissions (<all_urls>) for a simple entertainment extension
• Privacy policy not scoped to extension specifics

Evidence

• maintenance_stale store 17 months since update exceeds 12-month threshold
• verified_publisher store Verified publisher badge and featured status
• broad_host_access crx <all_urls> and file://* for goose companion app
• privacy_scope api Privacy policy fetched but not extension-scoped
• no_cves api No CVE findings in bundled libraries
• clean_code crx No code findings, no obfuscation detected
• low_installs store 7,000 installs with high-tier permissions

Permissions Breakdown

• storage low Standard extension data storage
• <all_urls> high Broad host access for content scripts
• file://* medium File system access

Pillar Scores

Bookkeeping