Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; data collection/sharing admitted with no extension context.
• Developer uses iCloud free email; no verified business identity or domain.
• Content script runs on web.whatsapp.com, can read chat content; data posted to third-party prontei.com API.
• js_external_hosts includes discoveric.ru (Russian-hosted domain) and adm.watidy.com — unexpected for a WhatsApp voice tool.
• eval() in bundled audio encoder libs without CSP increases code-injection risk.

Evidence

• privacy_policy_generic store Policy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true — scores +10.0.
• free_email_dev store Developer email hebrain@icloud.com; iCloud is free mail; no verified business website.
• suspicious_external_hosts crx discoveric.ru (RU-hosted) and adm.watidy.com contacted by extension JS; unrelated to stated WhatsApp voice function.
• eval_in_libs crx eval(funcstr) in Mp3LameEncoder.min.js and OggVorbisEncoder.min.js; function_constructor in sweetalert2.js.
• no_csp manifest content_security_policy is null; MV3 default applies but eval findings still increase injection risk.
• whatsapp_content_script manifest Content script injected into web.whatsapp.com; can access full chat DOM and data.
• geo_diversity crx JS external hosts span 3 countries (CA, RU, US); RU endpoint (discoveric.ru) is anomalous for this category.
• third_party_api_endpoint manifest host_permission to app.prontei.com/api/* allows sending WhatsApp session data to external service.

Permissions Breakdown

• storage low Local key-value storage; minimal risk on its own.
• unlimitedStorage low Allows large local storage quota; no direct data-exfil risk.
• host: https://web.whatsapp.com/* medium Content script on WhatsApp web — can read/inject into chat sessions.
• host: https://app.prontei.com/api/* medium Scoped API endpoint; data from WhatsApp context may be sent here.

Pillar Scores

Bookkeeping