Top Risks

• declarativeNetRequestWithHostAccess + <all_urls>: can silently redirect/modify all HTTP traffic on every site.
• Content scripts injected on all URLs can harvest credentials from any page, contradicting offline-vault promise.
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verifiable business identity; unverified publisher on a password manager.
• External JS hosts (example.com, foo.bar, speed.cloudflare.com) are anomalous for an offline cryptographic vault.

Evidence

• declarativeNetRequestWithHostAccess + <all_urls> manifest HIGH perm paired with broad host access; x1.2 multiplier applied. Password manager has no need to redirect network requests.
• content_scripts on <all_urls> manifest JS injected into every site visited; capable of reading any credential field, contradicting offline-local claim.
• privacy_policy is Google account policy store scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) rule: +10.0 privacy pillar.
• free-webmail developer, no verified publisher store hunkiepeanut.dev@gmail.com; free-webmail + no business website floor => reputation >= 7.5.
• anomalous external JS hosts crx js_external_hosts includes foo.bar and example.com — placeholder/test domains in a production security extension.
• install_perm_anomaly: small_install_high_perm api Only 3 installs but exercises HIGH-tier permissions; tail attack surface concern per rubric rule (11).
• no CSP defined manifest csp_present=false on MV3; no content_security_policy set, weaker runtime injection controls.
• obfuscation and code findings crx obfuscation_score=0.0, code_findings_raw=[]; no obfuscation or malicious patterns detected — code quality pillar = 0.

Permissions Breakdown

• storage low Needed to persist vault data locally; low risk in isolation.
• declarativeNetRequestWithHostAccess high HIGH-tier: can intercept/modify network requests on all URLs; high abuse potential.
• <all_urls> (host_permissions) high Broad host access across every site; amplifies declarativeNetRequestWithHostAccess risk x1.2.
• content_scripts <all_urls> high JS injected into every page; can read DOM/credentials on any site.

Pillar Scores

Bookkeeping