Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• content_scripts declared on <all_urls> giving DOM access on every page visited.
• Developer uses free Gmail address (rovohq@gmail.com) with no verified business identity.
• Extension contacts api.lemonsqueezy.com (payment/SaaS platform) and github.com — purpose unclear for a word counter.
• No CSP defined (MV3 mitigates somewhat, but outbound host risk remains unmitigated).

Evidence

• content_scripts_matches manifest content_scripts run on <all_urls> — broad DOM read capability across all sites.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• js_external_hosts crx Contacts api.lemonsqueezy.com and github.com; unexpected for a local word-counter tool.
• developer_email store Gmail address rovohq@gmail.com; no verified publisher badge; no business domain.
• no_csp manifest content_security_policy is null; MV3 provides baseline but no explicit CSP hardening.
• cve_findings_raw crx No CVEs detected; no known-bad hosts; cve_pillar = 0.0.
• code_findings_raw crx No suspicious code patterns detected; obfuscation_score = 0.0.
• install_count store Only 62 installs; very low traction; no ratings available.

Permissions Breakdown

• contextMenus low Adds right-click menu items; limited impact.
• activeTab low Access to current tab only on user action.
• scripting medium Can inject scripts; paired with content_scripts <all_urls> raises scope.
• storage low Local extension storage only.
• tabs medium Can read tab URLs and titles across all tabs.
• content_scripts <all_urls> high Content scripts run on every page, enabling broad DOM access.

Pillar Scores

Bookkeeping