Top Risks

• Broad host access (*://*/*) + content scripts on all pages: can read page content on every site including other crypto/financial services.
• Privacy policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — admits data collection and 3rd-party sharing without scoping to this extension (D rule: +10.0 privacy).
• CSP connect-src is '*' allowing outbound connections to any host; combined with broad host permissions raises exfil concern.
• No developer_name listed; only email on throwaway-checked domain; reduces accountability.
• uninstall_url_hijack=true though target is null; flag for monitoring.

Evidence

• broad_host_access manifest host_permissions and content_scripts_matches both *://*/* — content scripts injected on every site.
• csp_connect_src_broad crx CSP connect-src is '*'; allows extension to beacon data to any endpoint.
• privacy_policy_d_rule api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 per v3.5 rule D.
• no_developer_name store developer_name is empty string; only hello@secretkeylabs.com available.
• uninstall_url_hijack crx uninstall_url_hijack=true (target null); setUninstallURL call detected.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust badges.
• cve_clean crx cve_findings_raw empty; no known CVEs in bundled libs.
• code_clean crx code_findings_raw empty; obfuscation_score=0.0; no external JS hosts.

Permissions Breakdown

• storage low Local key/wallet state persistence; expected for crypto wallet.
• tabs medium Can read tab URLs; used for dApp injection detection.
• sidePanel low Renders wallet UI in side panel; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; broad capability.
• webNavigation medium Monitors navigation events across all tabs.
• *://*/* (host_permission) high Broad host access allows content script injection on every site.
• *://*/* (content_scripts_matches) high Content scripts run on every page; can read/modify page DOM including credentials.

Pillar Scores

Bookkeeping