Top Risks

• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing: +10.0 privacy pillar.
• No developer name listed; verified publisher badge present but policy mismatch undermines trust.
• Extension is 16 months stale with zero JS files scanned — cannot verify actual functionality; ghost-extension risk.
• Manifest has zero permissions, zero JS, zero content scripts — 'empty manifest' anomaly for a theme extension raises legitimacy questions.
• MV3 with no CSP and no code surface: low observable risk today but governance gap if update adds capabilities.

Evidence

• privacy_policy_generic store Policy URL is Google's account privacy page — scope_extension=false, data_collection=true, third_party_sharing=true. Scores +10.0 on Privacy pillar per v3.5 rule D.
• no_developer_name store developer_name is empty string. Reputation +1.0 for missing 'Offered by' identity.
• verified_publisher store verified_publisher=true; grants Reputation discount. Capped at -1.0 per 0c because months_since_update=16 > 12 (no monetization/CVE triggers but stale threshold applies).
• empty_manifest_with_installs manifest permissions=[], host_permissions=[], content_scripts=[], js_file_count=0, obfuscation=0, code_findings empty. 1000 installs — v3.5B +1.5 not triggered (<100k).
• maintenance_stale store 16 months since update → Maintenance pillar +6.0.
• no_code_surface crx js_files_scanned=0, code_findings_raw=[], obfuscation_score=0.0. Code quality pillar = 0.
• cve_findings_empty crx cve_findings_raw=[]; CVE pillar = 0.0.
• threat_intel_clean api bad_host_hits=[], monetization_hits=[], affiliate_hits=[], developer domain resolves, looks_throwaway=false.

Pillar Scores

Bookkeeping