Top Risks

• clipboardRead+clipboardWrite on content_scripts <all_urls>: reads clipboard data from every site the user visits.
• No CSP defined; no boundary on script execution — Function constructor findings more impactful.
• Gmail developer with no verified business identity; domain_age_ct not queryable.
• Privacy policy discloses third-party sharing; retention stated but sharing scope broad.
• tinyurl.com in js_external_hosts — potential URL-shortener redirection surface.

Evidence

• content_scripts_matches=<all_urls> manifest Extension injects into every page; combines with clipboardRead for broad data access.
• no_csp manifest content_security_policy is null; MV3 default applies but Function() findings still present.
• gmail_developer store developer_email phanlequang99@gmail.com; no developer_name; free-webmail identity.
• verified_publisher+featured store verified_publisher=true and is_featured_by_google=true; reputation discounts apply.
• function_constructor_x2 crx new Function() in popup.js and background.js; likely bundler artifact but no obfuscation.
• tinyurl_in_external_hosts crx tinyurl.com listed in js_external_hosts; could facilitate opaque redirects.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• no_bad_hosts_no_affiliates api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits; clean threat profile.

Permissions Breakdown

• storage low Local data persistence; expected for clipboard manager.
• clipboardRead high Reads all clipboard content — core sensitive capability.
• clipboardWrite high Can overwrite clipboard contents at will.
• contextMenus low UI integration only.
• activeTab medium Access to current tab on user action.
• scripting medium Can inject scripts into pages; medium without broad host access.
• offscreen low Offscreen document for clipboard API; expected pattern.
• content_scripts:<all_urls> high Content script runs on every page; broad reach for a clipboard tool.

Pillar Scores

Bookkeeping