Top Risks

• Brand impersonation signal: extension name includes Google trademark but developer is not Google (confirmed_owner=false).
• Privacy policy discloses third-party sharing but lacks data retention clause; third_party_sharing=true.
• dom_sink_innerhtml_userctrl in Autolinker.js introduces DOM-XSS risk; no CSP to mitigate.
• 12 external JS hosts contacted including facebook.com and multiple GCP run.app endpoints; broad network surface.
• No developer display name in listing; identity anchored only to jasonsavard.com email.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'google'; confirmed_owner=false; verified_publisher=true so +1.0 not +2.0.
• verified_publisher store verified_publisher=true; applied -3.0 reputation discount capped per invariant 0c (no stale/CVE/monetization triggers).
• no_developer_name store developer_name is empty string; +1.0 reputation penalty applied.
• innerHTML_sink crx dom_sink_innerhtml_userctrl in Autolinker.js; no CSP present so elevated to +2.0 code quality.
• no_csp_mv3 manifest content_security_policy=null; MV3 has strict default so no +2.0 network penalty; but DOM sink risk elevated.
• privacy_policy_third_party api third_party_sharing=true, retention=false, scope_extension=true, data_collection=true → +1.0 retention + +1.0 third_party.
• external_hosts crx 12 distinct external hosts including www.facebook.com, multiple GCP run.app; >3 distinct registrable domains → +1.5 network.
• installs_300k store 300,000 installs triggers +1.0 (>100k) and +1.0 (>10k) webstore signals.

Permissions Breakdown

• alarms low Schedules background checks for calendar events.
• storage low Stores user preferences locally.
• tts low Text-to-speech for event notifications; expected for calendar tool.
• idle low Detects idle state to throttle polling.
• contextMenus low Adds right-click menu items.
• notifications low Shows calendar event reminders.
• activeTab medium Accesses the currently active tab on user interaction.
• gcm medium Google Cloud Messaging for push calendar updates; some data-channel risk.
• identity medium OAuth token access; required for Google Calendar API authentication.
• unlimitedStorage low Stores large calendar data locally.
• system.display low Reads display info for popup positioning.
• offscreen low MV3 offscreen document for background tasks.
• scripting medium Can inject scripts into pages; no broad host_permissions listed so scope limited.
• sidePanel low Renders calendar in browser side panel.

Pillar Scores

Bookkeeping