Top Risks

• Brand impersonation: mentions 'github' without verified ownership, dev email is free webmail.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Extension last updated 56 months ago (Oct 2021) — abandoned, no maintenance.
• Free-webmail developer (gmail) with no business website raises identity accountability concerns.
• MV3 with scripting + tabs + webNavigation can read GitHub PR pages broadly despite narrow content_scripts.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer domain is gmail.com, not GitHub.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• abandoned_extension store Last updated October 2021, 56 months ago. No changelog visible.
• free_webmail_developer manifest Developer email cpcolella@gmail.com; no business domain or verified publisher badge.
• no_csp crx content_security_policy is empty object; csp_present=false on MV3 (strict default applies, no network penalty).
• no_bad_hosts crx threat_intel.bad_host_hits=[], affiliate_hits=[], monetization_hits=[]. No threat-intel hits.
• clean_code_scan crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[]. No malicious indicators.
• narrow_host_scope manifest host_permissions and content_scripts scoped to github.com/*/pull/* — matches stated PR-helper function.

Permissions Breakdown

• activeTab low Access to currently active tab only on user interaction.
• tabs medium Can read tab URLs and titles across sessions.
• declarativeContent low Used to conditionally activate extension on specific pages.
• storage low Local extension storage, no remote sync implied.
• webNavigation medium Can observe navigation events across tabs.
• scripting medium Can inject scripts into pages matching host permissions.
• http://github.com/* medium Host access scoped to GitHub only; matches stated function.
• https://github.com/* medium Host access scoped to GitHub only; matches stated function.

Pillar Scores

Bookkeeping