Top Risks

• Broad host access (*://*/* + <all_urls>) with content scripts on every page — high exfil surface if compromised.
• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection & third-party sharing) — scores maximum privacy risk.
• Developer email on googlegroups.com mailing list, no developer name, no dedicated business domain — unverifiable identity.
• No CSP on MV3 extension with broad host permissions increases exploitation risk if code is injected.
• Justified-broad-permission discount partially offsets permissions (DeveloperTools + JSON formatting matches host access need).

Evidence

• broad_host_permissions manifest host_permissions: ['*://*/*', '<all_urls>'] and content_scripts on <all_urls> — reads every page.
• privacy_policy_generic store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• developer_identity_weak store developer_name empty, email arnav-kumar@googlegroups.com — no business domain, unverifiable.
• verified_publisher store verified_publisher=true; reduces Reputation pillar but capped by weak identity signals.
• no_csp manifest content_security_policy=null on MV3; no CSP hardening in place.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[] — no malicious signals detected.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; no known-bad infrastructure.
• recently_updated store months_since_update=1 — actively maintained; maintenance pillar = 0.

Permissions Breakdown

• storage low Local preference storage; low standalone risk.
• unlimitedStorage low Allows large local data; minor risk for a formatter.
• *://*/* high Broad host access — content scripts run on all URLs.
• <all_urls> high Redundant broad host permission; full-page access on every site.
• content_scripts:<all_urls> high Content script injected on every page, expanding attack surface.

Pillar Scores

Bookkeeping