Top Risks

• Broad host_permissions + content_scripts on *://*/* far exceeds what a local notepad requires.
• Privacy policy is Google's generic account policy — not scoped to this extension at all; admits data collection and 3rd-party sharing.
• Developer identity is a numbered-alias Gmail (0.teambolt@gmail.com) with no business name or website.
• Uninstall URL hijack flag set (uninstall_url_hijack=true) indicating onUninstall redirect configured.
• install_perm_anomaly: small install base (202) combined with HIGH-tier permissions raises tail-attack-surface concern.

Evidence

• broad_host_permissions manifest host_permissions and content_scripts both declare *://*/* — unnecessary for a side-panel notepad.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension sets an uninstall redirect URL.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true — policy admits sharing without extension scope.
• developer_identity store developer_name empty; email is numbered-alias Gmail 0.teambolt@gmail.com; no business website.
• install_perm_anomaly api small_install_high_perm=true; only 202 installs but HIGH-tier host permissions declared.
• maintenance store Last updated June 2025; months_since_update=12; borderline 6-12 month stale band.
• cve_findings crx No CVEs detected; no known-bad hosts; obfuscation_score=0.0; code_findings empty.

Permissions Breakdown

• sidePanel low Displays UI in browser side panel; no data access.
• unlimitedStorage low Allows large local storage; no exfil risk on its own.
• storage low Standard local key-value store; low sensitivity.
• background low Persistent service worker; needed for side panel but adds persistence surface.
• *://*/* (host_permissions) high Broad host access paired with content_scripts on all URLs; can read/modify any page.
• *://*/* (content_scripts_matches) high Content script injected on every page; high reach even for a notepad app.

Pillar Scores

Bookkeeping