Top Risks

• debugger_attach in background.js: extension attaches Chrome debugger to active tab, enabling full DOM/network inspection.
• desktopCapture + <all_urls> + scripting combo gives near-total visibility into user screen and all web content.
• Developer email is free Gmail with no business name; verified_publisher badge but no disclosed org identity.
• new Function() constructor used across 5 JS files; potential code execution surface despite low obfuscation score.
• Content scripts injected on <all_urls> including all sites, not scoped to qooly.com despite narrow stated function.

Evidence

• debugger_attach crx background.js attaches chrome.debugger to active tab at protocol 1.2 — grants full devtools-level access.
• function_constructor crx new Function() constructor found in background.js, content-script.js, popup.js, recorder.js, settings.js.
• desktopCapture + scripting + <all_urls> manifest High-capability combo: desktop screen capture + script injection on all URLs.
• no_csp manifest content_security_policy is null/absent on MV3 extension; slightly elevated risk for code execution.
• developer_identity store Developer email is free Gmail, no developer_name set, no org identity despite verified_publisher badge.
• verified_publisher + featured store Extension carries both verified publisher and Google Featured badges, providing moderate reputation credit.
• privacy_policy store Privacy policy at qooly.com/privacy-policy: scoped, data_collection=true, retention=true, third_party_sharing=true.
• no_cve_findings crx No CVEs found in bundled libraries; cve_findings_raw is empty.

Permissions Breakdown

• storage low Local data persistence; low risk for screen recorder.
• activeTab medium Access to current tab; expected for capture extension.
• tabCapture high Captures tab audio/video; core function but high sensitivity.
• unlimitedStorage low Needed for storing large video recordings.
• desktopCapture high Captures full desktop or app windows; extremely sensitive.
• scripting high Injects scripts into pages; paired with <all_urls> is high risk.
• <all_urls> high Broad host access across all sites; amplifies scripting/tabCapture risk.

Pillar Scores

Bookkeeping