Top Risks

• Abandoned: last updated 41 months ago, well past >36mo maintenance ceiling (score 10.0).
• Privacy policy is Google's generic account policy — fetched, not scoped to this extension, admits data collection and third-party sharing (+10.0 privacy).
• Free-webmail developer (gmail) with no verified business website raises accountability concerns.
• No CSP on MV3 extension; external JS hosts (cdn.jsdelivr.net, jquery.com) contacted without integrity constraints.
• Only 14 installs with no ratings — near-zero community signal; longevity risk if ever acquired.

Evidence

• maintenance_stale store Last updated January 23, 2023 — 41 months ago; >36mo band = maintenance score 10.0.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → privacy score 10.0.
• developer_identity store Developer email is gmail.com free webmail; no verified publisher; no business domain.
• external_js_hosts crx Extension loads from cdn.jsdelivr.net and jquery.com; no CSP to enforce SRI/integrity.
• no_csp manifest content_security_policy is null on MV3 extension; +2.0 Network (MV2+no-CSP rule not triggered but external CDN unguarded).
• low_installs store Only 14 installs; no community validation; acquisition risk if ever listed for sale.
• cve_findings crx No CVEs detected in bundled libraries; cve_findings_raw is empty.
• code_findings crx No malicious code patterns detected; obfuscation_score=0.0; code_findings_raw empty.

Permissions Breakdown

• tabs medium Can read tab URLs/titles; moderate risk but no broad host access paired.
• host_permissions: https://dev.to/* low Narrow scope to single domain matching stated function.

Pillar Scores

Bookkeeping