Top Risks

• Broad host access to all_urls combined with AI page content processing
• Low rating (2.6) suggests quality or trust issues
• Missing Content Security Policy increases XSS risk surface
• DOM-XSS sink detected in popup.js
• Contacts many distinct external hosts including api.openai.com and payment domains

Evidence

• permissions manifest Broad host permission <all_urls> and content_scripts on all sites; OpenAI API also allowed.
• manifest_version manifest MV3 extension with activeTab, scripting, tabs, storage, alarms, contextMenus.
• privacy_policy crx Privacy policy fetched and scoped; collection, retention, and sharing disclosed.
• code_quality crx No obfuscation; one innerHTML user-controlled DOM sink detected in popup.js.
• network_behavior crx Many external hosts including api.openai.com, unpkg.com, rightclickpay.atrus.uk, Notion domains.
• webstore_signals store 5,000 installs, rating 2.6, no verified publisher, no featured badge.
• reputation store Developer domain abundant.agency is established (2021); no impersonation or bad reviews detected.
• cve_findings crx No CVEs reported in bundled JS libraries; no vulnerable dependencies detected.

Permissions Breakdown

• activeTab low Access to currently focused tab when invoked by user.
• scripting medium Allows injection of scripts into pages via user action.
• contextMenus low Adds right-click menu items.
• storage low Stores extension state and settings locally.
• alarms low Schedules delayed or periodic background tasks.
• tabs medium Can query and interact with open tabs across sites.
• <all_urls> high Broad host access across all visited websites.
• https://api.openai.com/* medium Explicit network access to OpenAI API for AI features.

Pillar Scores

Bookkeeping