Top Risks

• ChatGPT brand impersonation by unverified gmail developer with numbered alias (automatemylife00@gmail.com).
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and third-party sharing.
• Extension stale for 32 months (>24mo) with no update, indicating abandoned or zombie state.
• No CSP present (MV3 default only); +2.0 Network penalty for MV2-style gap on MV3 without explicit policy.
• Rating of 1.0 from a free-webmail developer with no business identity raises credibility concern.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'chatgpt'; developer is gmail user automatemylife00, not OpenAI.
• free_webmail_developer store Developer email automatemylife00@gmail.com; numbered alias; no business domain; developer_domain_info=null.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true per classification.
• stale_extension store Last updated October 2023; 32 months since update — zombie tier (>24mo).
• no_csp manifest content_security_policy=null; csp_present=false; MV3 but no explicit CSP declared.
• low_rating store Rating=1.0; rating_count unknown; is_featured_by_google=true despite poor rating.
• content_script_scope manifest content_scripts_matches=['https://chat.openai.com/*']; narrow scope but injects into ChatGPT session.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[]; 1 JS file scanned — no malicious signals detected.

Permissions Breakdown

• content_scripts: https://chat.openai.com/* medium Script injection scoped to chat.openai.com only; narrow but reads/modifies ChatGPT page DOM.

Pillar Scores

Bookkeeping