Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• broad host_permissions (https://*/*) + scripting + webRequest enables full page read/modify across all sites.
• new Function() constructor in metadataEngine.chunk.js allows dynamic code execution.
• install_url_hijack flag set — extension opens a URL on install; target is null so destination is unverified.
• No developer display name; verified publisher but privacy policy is wholly inadequate.

Evidence

• broad_host_permissions manifest https://*/* grants content_script and scripting access to every HTTPS site visited.
• privacy_policy_generic store Policy URL is Google account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() found in metadataEngine.chunk.js — dynamic code execution risk.
• install_url_hijack crx install_url_hijack=true with null target; opens URL on install without disclosed destination.
• verified_publisher store Extension carries verified_publisher=true; developer domain zkp2p.xyz resolves.
• external_hosts crx Contacts api.zkp2p.xyz, attestation-service.zkp2p.xyz, peer.xyz, viem.sh — 4 distinct domains.
• no_developer_name store developer_name is empty; only email team@zkp2p.xyz provided.
• cve_clean crx No CVE findings detected in bundled JS libraries; obfuscation_score=0.0.

Permissions Breakdown

• webRequest high Can observe all HTTP request metadata across all visited URLs.
• scripting high Dynamic script injection into pages; combined with https://*/* is very broad.
• tabs medium Access to URL, title, and navigation state of all open tabs.
• offscreen low Creates hidden offscreen document; low risk alone but expands background execution surface.
• https://*/* high Broad host permission covering all HTTPS sites; paired with scripting and webRequest.
• http://localhost/* low Limited to localhost; needed for local ZKP verification service.

Pillar Scores

Bookkeeping