Top Risks

• Privacy policy is Google's generic account policy (scope_extension=false), admits data collection and third-party sharing — not scoped to this extension.
• Free-webmail developer (gmail) with no verified business identity raises accountability concerns.
• Extension stale at 16 months since last update; no changelog visible.
• No CSP declared (MV3 mitigates but absence still noted).
• Very low install base (82) limits confidence in community vetting.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → privacy pillar +10.0.
• developer_free_webmail store Developer email arthur.k.tripp+dev@gmail.com is free webmail with no associated business domain.
• maintenance_stale store Last updated February 13, 2025; 16 months since update → maintenance +6.0 (12-24mo band).
• no_cve_findings crx cve_findings_raw is empty; CVE pillar = 0.0.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; code quality pillar = 0.0.
• minimal_permissions manifest Only activeTab declared; no host_permissions, no content_scripts, no HIGH-tier permissions.
• js_external_hosts crx Extension contacts creativecommons.org and dns.google — consistent with DNS lookup tool; no bad/monetization/affiliate hits.
• operator_cluster_clean api sibling_count=0; no related suspicious extensions under same fingerprint.

Permissions Breakdown

• activeTab low Only activates on user-initiated action; no persistent host access.

Pillar Scores

Bookkeeping