Top Risks

• Google's generic privacy policy linked — admits data collection and 3rd-party sharing with no scope to this extension.
• declarativeNetRequestWithHostAccess + <all_urls> enables interception of all web traffic with no accountability.
• Free-webmail developer (gmail) with no verified business identity or verifiable domain.
• External JS hosts include 'foo.bar' and 'example.com' — nonsensical/placeholder endpoints suggest incomplete or deceptive build.
• Description promises 'download' capability but lacks 'downloads' permission — permission/description mismatch.

Evidence

• privacy_policy_generic store Policy is Google's own account policy: scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy (v3.5 rule D).
• high_permissions_broad_host manifest declarativeNetRequestWithHostAccess + <all_urls> host_permissions + content_scripts on <all_urls> = broad traffic interception capability.
• suspicious_external_hosts crx js_external_hosts includes 'foo.bar' and 'example.com' — placeholder/invalid domains in a published extension.
• free_webmail_developer store Developer email hunkiepeanut.dev@gmail.com; no business website; unverified identity (domain_age_ct skipped as free webmail).
• description_permission_mismatch store Description promises download functionality; 'downloads' permission absent.
• no_installs_no_rating store Install count empty, rating 0 — no user base to validate legitimacy.
• csp_absent_mv3 manifest csp_present=false; MV3 has strict default but external host list includes junk domains.
• operator_cluster_singleton api sibling_count=0; no cluster risk, but developer identity entirely unverifiable.

Permissions Breakdown

• activeTab low Only accesses currently active tab on user interaction.
• scripting medium Allows injecting scripts into pages; elevated with <all_urls> host access.
• storage low Local/sync storage access; limited blast radius.
• declarativeNetRequestWithHostAccess high Can intercept/modify network requests across all URLs — high capability.
• <all_urls> (host_permissions) high Grants access to every site visited; amplifies all other permissions.
• <all_urls> (content_scripts) high Content scripts run on every page, enabling broad data access.

Pillar Scores

Bookkeeping