Top Risks

• nativeMessaging with unrecognized publisher bridges extension to OS-level native app (+3.0 permissions).
• Privacy policy fetched but scope_extension==false AND data_collection+third_party_sharing==true → admits broad data sharing without scoping to this extension (+10.0 privacy).
• Broad *://*/* host permissions + scripting gives full page read/write capability across all sites.
• developer_name empty and no verified-publisher badge limits accountability signals (+0.5 reputation).
• uninstall_url_hijack flag set true; target is null but signal warrants review.

Evidence

• nativeMessaging + publisher_recognized==false manifest native_messaging_check.publisher_recognized=false; companion app identity unverifiable, +3.0 permissions.
• Privacy policy: scope_extension=false, data_collection=true, third_party_sharing=true crx Policy fetched but does not scope to extension; admits collection+3rd-party sharing → +10.0 privacy (D rule).
• host_permissions *://*/* + content_scripts *://*/* manifest Full broad host access paired with scripting permission enables page content manipulation on all URLs.
• uninstall_url_hijack=true crx Extension sets uninstall URL; target is null in scan data. Warrants manual verification.
• developer_name empty store No 'Offered by' display name; reduces accountability. Email domain getalby.com resolves and is not throwaway.
• MV3 + CSP present manifest script-src 'self' 'wasm-unsafe-eval'; no remote CDN in CSP; no network penalty applied.
• No bad/affiliate/monetization hosts crx threat_intel shows all hit lists empty; developer domain resolves; looks_throwaway=false.
• code_findings_raw empty, obfuscation_score=0.0 crx No suspicious JS patterns detected; code quality pillar scores 0.0.

Permissions Breakdown

• nativeMessaging high Bridges to native OS apps; publisher_recognized==false adds +3.0 to permissions.
• scripting high Programmatic script injection into pages; paired with *://*/* host access.
• tabs medium Access to tab URLs and metadata across all sites.
• notifications low Display notifications; low standalone risk.
• storage low Local extension storage; expected for a wallet.
• unlimitedStorage low Removes storage quota; expected for wallet/key data.
• contextMenus low Adds right-click menu items; low risk.
• *://*/* (host_permissions) high Broad host access enables content scripts and scripting on every site.

Pillar Scores

Bookkeeping