Top Risks

• innerHTML DOM-XSS sinks in 16 files; CSP present reduces but doesn't eliminate risk
• Function constructor on user-controlled input (snu-testcommand-runner.js)
• chrome.debugger attachment capability in cdp-adapter.js
• cookies permission scoped to service-now.com domains
• Privacy policy does not disclose data retention practices

Evidence

• permissions manifest cookies (HIGH) + service-now.com host access, scoped to platform
• reputation store Developer email at snutils.com, no verified badge, no free webmail
• network_behavior crx CSP present, connect-src scoped to service-now.com + snutils.com
• webstore_signals store 100K installs, 4.8 rating, no bad hosts, no impersonation
• maintenance store Updated October 27, 2026, 0 months ago
• privacy api Policy fetched, scoped, collection disclosed, retention not disclosed
• code_quality crx 16 innerHTML sinks, Function constructor, debugger.attach, obfuscation 0.0
• cve_exposure api No CVEs in bundled libraries, minimum Chrome 114

Permissions Breakdown

• activeTab low User-initiated tab access, low risk
• declarativeContent low Content script injection rules, low risk
• storage low Local storage, low risk
• contextMenus low Context menu items, low risk
• cookies high Can read/modify cookies, HIGH risk with host access
• sidePanel low Side panel UI, low risk
• https://*.service-now.com/* medium Host access to ServiceNow domains, scoped to stated function

Pillar Scores

Bookkeeping