Top Risks

• script_src_dynamic + function_constructor across multiple bundles raises DOM-XSS and code-injection risk despite MV3.
• tabCapture + scripting + <all_urls> enables full audio/video capture of any tab — high-value if extension ever compromised.
• innerHTML sinks in contentScript.bundle.js injected on all URLs; exploitable if attacker controls page content.
• No developer display name on listing; developer identity relies solely on verified-publisher badge.
• Privacy policy discloses third-party sharing without granular extension-specific data retention scope.

Evidence

• verified_publisher + featured store Verified publisher badge and Google Featured badge present; reputation floor applied.
• script_src_dynamic in 4 bundles crx Webpack chunk-loading pattern creates dynamic script elements; likely bundler artifact but raises code-quality score.
• function_constructor in 4 bundles crx new Function() used in recorder, region, background, editor bundles; editor.bundle.js applies it to window.
• innerHTML sinks in 10 files crx Pervasive innerHTML pattern across all bundles; React reconciler pattern but content_scripts on <all_urls> amplifies risk.
• cve_findings_raw empty crx No known CVEs in bundled libraries detected.
• threat_intel clean api No bad hosts, monetization hits, affiliate hits, or throwaway domain signals.
• privacy_policy scoped with retention api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• obfuscation_score 0.0 crx No obfuscation detected; 42 JS files scanned cleanly.

Permissions Breakdown

• identity low Used for optional cloud save; no broad scope declared.
• activeTab low Transient tab access on user gesture only.
• storage low Local settings persistence; standard for recorder tools.
• unlimitedStorage low Needed to store large video recordings locally.
• downloads medium Can save files to disk; expected for video downloader category.
• tabs medium Can read tab URLs/titles across all open tabs.
• tabCapture high Captures full tab audio/video stream — core to recorder but high sensitivity.
• scripting high Can inject scripts into any page via <all_urls> host permission.
• system.display low Reads display info for region selection; read-only.
• <all_urls> (host_permission) high Combined with scripting and tabCapture gives broad page access; justified by recorder function.

Pillar Scores

Bookkeeping