Top Risks

• Privacy policy URL returns SSL error (unfetchable); treated as no effective policy — score 10.0 on privacy pillar.
• Developer email is numbered QQ alias (throwaway signal); no developer name disclosed.
• Content scripts run on <all_urls> injecting DOM code into every visited site.
• External JS hosts include raw.github.com and stuartk.com — remote resource loading risk without CSP.
• No CSP defined (MV3 so no +2 penalty, but innerHTML sink without CSP raises DOM-XSS concern).

Evidence

• privacy_policy_fetch_failed api Privacy policy SSL error on fetch; classified as fetched==false → privacy pillar 10.0.
• developer_throwaway_email store Email 59046564@qq.com is numbered QQ alias; threat_intel marks looks_throwaway=true.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; DOM access on every site.
• external_js_hosts crx 5 external hosts: github.com, raw.github.com, stuartk.com, stuk.github.io, aliyuncs.com.
• dom_xss_sink crx innerHTML assigned from variable in js/output.js; no CSP to mitigate.
• install_url_hijack manifest onInstalled opens page.html — minor UX hijack but not 3rd-party redirect.
• no_developer_name store developer_name field is empty; accountability gap.
• maintenance_stale store 18 months since last update; at boundary of 12-24mo band (+6.0).

Permissions Breakdown

• storage low Low-risk local data persistence; standard for downloaders.
• downloads medium Can initiate file downloads to user's disk; matches stated image-downloader function.
• contextMenus low Adds right-click menu items; low inherent risk.
• content_scripts <all_urls> medium Script injected on every site; reads page DOM across all origins.

Pillar Scores

Bookkeeping