Top Risks

• Privacy policy is generic Google account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Brand impersonation flag: extension name/description mentions 'GitHub' and developer is unverified gmail user.
• No CSP declared (MV3 default is strict, but innerHTML sink + new Function() in content.js elevates DOM-XSS risk.
• Free-webmail developer (gmail.com) with no verified business presence increases identity/accountability risk.
• Uninstall URL hijack flag set — destination unresolved but pattern warrants review.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer is unverified gmail user.
• free_webmail_developer store Developer email enixcoda@gmail.com; no verified publisher badge; developer_domain=gmail.com.
• dom_sink_innerHTML_no_csp crx innerHTML used in content.js with csp_present=false; DOM-XSS risk elevated per FIX B.
• function_constructor crx new Function() in content.js; typical in bundled polyfills but contributes to code quality score.
• uninstall_url_hijack crx uninstall_url_hijack=true; target URL unresolved. Potential 3rd-party redirect on removal.
• react_16_13_bundled crx React 16.13.0 bundled; below 16.14 threshold; no CVEs found in cve_findings_raw.
• sentry_host_permission manifest Host permission for *.sentry.io — error telemetry; legitimate but transmits runtime data.

Permissions Breakdown

• scripting medium Can inject JS into pages; scoped to github.com via content_scripts — medium risk.
• storage low Local data persistence only, no exfil risk on its own.
• contextMenus low UI element only, low impact.
• activeTab low Temporary access to current tab on user action, limited scope.
• *://*.github.com/* medium Broad access to github.com; matches stated function as GitHub file-tree tool.
• *://gitako.enix.one/* low Dev-controlled domain for extension backend/config.
• *://*.sentry.io/* low Error telemetry endpoint; known legitimate service.

Pillar Scores

Bookkeeping