Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Developer uses free Gmail address with no developer name or verifiable identity.
• Description promises 'recorded content' management but lacks tabCapture/desktopCapture permissions (mismatch).
• No install count available — blast radius unknown but likely minimal.
• No CSP declared (MV3 applies strict defaults, mitigating risk).

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.0.
• developer_identity store developer_email=raingardadavidson@gmail.com, developer_name empty, no business website → free-webmail floor 7.5 on Reputation.
• description_promise_mismatch manifest Promises recording but lacks tabCapture/desktopCapture; description_promise.mismatches non-empty → Webstore +2.0.
• permissions_minimal manifest Only 'storage' declared; no host permissions, no content scripts; very low capability.
• no_cve_findings crx cve_findings_raw empty; no bundled JS libs detected.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; 2 JS files scanned cleanly.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; js_external_hosts empty.
• maintenance_recent store months_since_update=2; Maintenance pillar=0.0.

Permissions Breakdown

• storage low Stores memo data locally; standard and expected for a memo extension.

Pillar Scores

Bookkeeping