Top Risks

• Privacy policy is off-scope (references Trustpilot exporter product, not this extension) and admits data collection + third-party sharing.
• Brand impersonation: Instagram™ trademark used in title by unverified gmail developer with no business domain.
• Install-redirect hijack: onInstalled opens instagram.com/explore/ — confirm no ad-click monetization.
• Uninstall URL hijack flag set (target null but flag true) — potential monetization hook.
• Free-webmail developer (gmail), no developer name, no business website; accountability is minimal.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'instagram'; developer_domain=gmail.com; confirmed_owner=false.
• privacy_policy_off_scope api Policy URL is for 'trustpilot-reviews-exporter'; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• install_url_hijack crx install_url_hijack=true; target=https://www.instagram.com/explore/ — opens 3rd-party URL on install.
• uninstall_url_hijack crx uninstall_url_hijack=true; target=null. Flag raised by scanner; potential monetization hook.
• free_webmail_developer store developer_email=m41m41.a@gmail.com; developer_name=''; no business website. Reputation floor applied.
• description_permission_mismatch store Promises 'download' in description but lacks 'downloads' permission. Capability mismatch.
• verified_publisher store verified_publisher=true AND is_featured_by_google=true; discount applied but capped per monetization checks.
• no_csp manifest csp_present=false on MV3; v2b +2.0 network penalty applied.

Permissions Breakdown

• activeTab low Only active tab on user gesture; scoped to Instagram by content_scripts.
• storage low Local key-value store; no exfil capability alone.
• sidePanel low UI surface only; no data access beyond active tab context.

Pillar Scores

Bookkeeping