Top Risks

• Self-described 'hacking extension' injects cheat code into Prodigy Math Game — explicit ToS violation and malware-adjacent behavior.
• Privacy policy URL failed to load (SSL error); treated as unfetched — no data handling disclosure.
• Install URL hijack: onInstalled opens third-party vercel.app URL, a known monetization/redirect shell tactic.
• Free-webmail developer (gmail) with generic 'WebApp' name and no verifiable business identity.
• Low rating (1.8) on a cheat-tool extension signals user harm; external JS loaded from prodigy2-mu.vercel.app at runtime.

Evidence

• explicit_cheat_tool store Manifest description: 'Inject cheat menu into Prodigy Math Game' — explicit ToS-violation purpose.
• install_url_hijack manifest onInstalled opens https://prodigy2-mu.vercel.app/ — third-party redirect on install.
• external_js_host crx js_external_hosts: prodigy2-mu.vercel.app — runtime remote code loading risk.
• privacy_policy_unfetched api fetch_error:SSLError on sites.google.com policy URL; privacy pillar scored as fetched==false.
• free_webmail_dev store Developer email cassierask821@gmail.com with generic name 'WebApp', no verifiable business.
• low_rating store Rating 1.8 — below-floor trust signal for a cheat-injection tool.
• content_script_scope manifest content_scripts_matches: *://*.prodigygame.com/* — scoped injection, not broad host access.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false — no trust anchors.

Permissions Breakdown

• content_scripts_matches: *://*.prodigygame.com/* medium Injects scripts into all pages on prodigygame.com; enables cheat injection per stated purpose.

Pillar Scores

Bookkeeping