Top Risks

• Privacy policy fetched but admits data collection and third-party sharing without scoping to this extension — worst-case disclosure.
• Brand impersonation: dev (gmail, no confirmed ownership) uses 'Amazon' branding without being Amazon.
• Free-webmail developer with no verified business identity; floor elevated to 7.5.
• Install-URL hijack opens third-party URL on install — low-trust onboarding signal.
• Only 6 installs with broad content-script access across 23 Amazon TLDs; tail attack surface.

Evidence

• privacy_policy_admits_third_party_sharing_no_scope api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 Privacy (v3.5 rule D).
• brand_impersonation store brand_mention.is_impersonation=true for 'amazon'; dev is gmail user, confirmed_owner=false → +2.0 Reputation.
• free_webmail_developer store ecomstal.official@gmail.com, no business website; Reputation floor applied at 7.5.
• install_url_hijack manifest install_url_hijack=true; extension opens third-party URL on install → +2.0 Webstore.
• broad_amazon_host_permissions manifest 23 Amazon TLD host_permissions + content_scripts; scoped to Amazon only, justified by stated function.
• cve_findings_empty crx No CVEs detected; CVE pillar = 0.0.
• code_findings_empty_obfuscation_zero crx code_findings_raw empty, obfuscation_score=0.0; Code Quality pillar = 0.0.
• no_csp_present_mv3 manifest csp_present=false; MV3 has strict default so no network penalty for missing CSP.

Permissions Breakdown

• storage low Stores local extension preferences; low direct harm.
• activeTab low Access current tab on user gesture only; scoped and low-risk.
• *://*.amazon.com/* (and 21 other Amazon TLDs) medium Broad host access across all Amazon domains; content scripts run on every Amazon page.

Pillar Scores

Bookkeeping