Top Risks

• Brand impersonation: extension references 'GitHub' brand but developer is unverified gmail user.
• Privacy policy is Google's generic account policy — does not scope to this extension at all.
• Free-webmail developer (gmail) with no verified business identity; no trust anchors.
• No CSP declared (MV3 provides default but no explicit hardening).
• Extremely low install count (63) with a 5-star rating — insufficient signal quality.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=['github'], confirmed_owner=false, developer_email is gmail.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store developer_email=akashv789@gmail.com; no business domain, no verified publisher badge.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit policy set.
• low_install_count store Only 63 installs; 5-star rating with no rating_count — insufficient evidence of trustworthiness.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty — benign surface.
• permissions_scope manifest Permissions: contextMenus, activeTab, scripting. No host_permissions. Low capability footprint.
• no_bad_hosts crx threat_intel.bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no threat-intel hits.

Permissions Breakdown

• contextMenus low Adds right-click menu items; minimal standalone risk.
• activeTab low Transient access to current tab on user action only; scoped.
• scripting medium Allows JS injection into pages; paired with activeTab limits scope but still capable.

Pillar Scores

Bookkeeping