Top Risks

• Privacy policy is Google's own account policy — not scoped to this extension at all, admits data collection and 3rd-party sharing (D rule: +10.0 privacy).
• Extension is 32 months stale (>24mo) — high abandonment / supply-chain takeover risk.
• Wayback ownership data unavailable (timeout); cannot rule out silent developer transfer.
• Only 157 installs yet no observable code surface — empty CRX with no JS raises 'empty-manifest-with-installs' anomaly (v3.5-B partial signal).
• Developer has 24 sibling extensions under same email; volume-publisher pattern warrants scrutiny.

Evidence

• privacy_policy_generic store PP URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (rule D).
• stale_extension store months_since_update=32; falls in 24-36mo band → maintenance +8.5.
• no_permissions_no_js crx Zero permissions, host_permissions, content_scripts, and JS files. Extension has no observable capability; CRX appears theme-only shell.
• operator_cluster_dev_email api dev_email dimension shows 24 sibling extensions under info@gameograf.com; compound sibling_count=0 so no +2.5 cluster bonus applied.
• wayback_timeout api Wayback ownership check timed out; first_snapshot=null; ownership_changed=false by default — cannot confirm no transfer.
• domain_age_ok api gameograf.com first cert 2021-02-03, age_days=2051, cert_count=265; not new, resolves=true, looks_throwaway=false.
• no_bad_hosts_no_cves crx cve_findings_raw empty, bad_host_hits empty, affiliate_hits empty, monetization_hits empty.
• reputation_baseline store Not verified publisher, not featured by Google, no brand impersonation, no review red flags; baseline reputation 5.0.

Pillar Scores

Bookkeeping