Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, admits data_collection+third_party_sharing) — no extension-specific disclosure.
• Developer uses free-webmail (gmail.com) with no verified business identity; brand_mention flags LinkedIn impersonation.
• No CSP declared (MV3 mitigates somewhat, but no explicit policy).
• Low install count with LinkedIn brand name creates minor brand-impersonation concern.
• External JS host alpinejs.dev referenced; no CVEs but adds a supply-chain dependency.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy score.
• brand_impersonation store brand_mention.is_impersonation=true for 'linkedin'; developer is not confirmed owner; featured by Google partially mitigates.
• free_webmail_developer store Developer email mohit.mamoria@gmail.com; no business domain; raises reputation baseline.
• is_featured_by_google store Extension carries Google Featured badge, partially reducing reputation risk.
• no_csp manifest content_security_policy is null; MV3 enforces strict default so no Network +2.0 MV2 penalty applies.
• external_js_host crx js_external_hosts includes alpinejs.dev; no CVEs found; low supply-chain risk.
• code_findings_clean crx code_findings_raw empty, obfuscation_score=0.0; no malicious indicators detected.
• maintenance_current store months_since_update=0; extension updated June 2026; maintenance pillar=0.

Permissions Breakdown

• storage low Stores theme preferences locally; low risk.
• activeTab low Scoped to user-activated tab only; minimal risk.
• *://*.linkedin.com/* medium Content scripts run on all LinkedIn pages; scoped to single domain, justifiable for theme extension.

Pillar Scores

Bookkeeping