Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing (D rule → +10.0 privacy pillar).
• Uninstall and install URL hijacks detected — classic monetization/tracking shell pattern.
• description_promise.is_shell_pattern=true: extension promises to 'play' game but has zero permissions and empty content scripts — likely a redirect shell.
• No developer name supplied; verified publisher discount applies but shell indicators reduce trust.
• External JS host (gameograf.com) contacted despite near-empty manifest — unknown payload risk.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both uninstall and install URL hijacks flagged true; targets null but hooks are present — monetization shell pattern.
• shell_pattern crx description_promise.is_shell_pattern=true; promises play_or_open but zero permissions, no content_scripts, no host_permissions.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx Extension loads JS from gameograf.com despite having no declared host_permissions — opaque external dependency.
• verified_publisher store Verified publisher badge present; discount applied but capped due to shell/monetization indicators.
• no_developer_name store developer_name is empty string; adds +1.0 to reputation.
• domain_age api gameograf.com first cert 2021-02-03, age 2050 days, 265 certs — established domain, no throwaway signal.
• obfuscation_and_code_findings crx obfuscation_score=0.0, code_findings_raw empty, 2 JS files scanned — no malicious code detected.

Pillar Scores

Bookkeeping