Top Risks

• Uninstall URL hijack to third-party domain — monetization/tracking indicator on a 17-install extension.
• Privacy policy admits data collection and third-party sharing without scoping to this extension.
• Amazon brand impersonation by unverified gmail developer with no confirmed ownership.
• Free-webmail dev email with numbered alias pattern; no verified publisher; low accountability.
• External JS hosts (10xprofit.io, app.10xprofit.io) loaded in Amazon content scripts — data exfil surface.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to https://10xprofit.io/tools — third-party redirect on uninstall.
• brand_impersonation store brand_mention.is_impersonation=true; developer domain is gmail.com, confirmed_owner=false for Amazon brand.
• privacy_policy_generic_scope api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy pillar.
• free_webmail_dev store Developer email 10xprofitio@gmail.com; no verified publisher; no recognized org.
• js_external_hosts crx Extension loads JS from 10xprofit.io and app.10xprofit.io alongside Amazon content scripts.
• numbered_alias_email store Email 10xprofitio@gmail.com matches numbered/alias pattern; +3.0 Webstore applied.
• csp_absent manifest content_security_policy is null on MV3; no additional CSP penalty on MV3 per rubric.
• host_permissions_scope manifest 18 Amazon TLD host_permissions + matching content_scripts; justified-broad discount applied (-1.5 Permissions).

Permissions Breakdown

• *://*.amazon.com/* (and 17 Amazon TLDs) medium Broad host access across all Amazon storefronts; content scripts injected on each; scoped to stated function.

Pillar Scores

Bookkeeping