Top Risks

• LinkedIn™ brand impersonation by unverified gmail developer; confirmed_owner=false raises phishing/trust risk.
• cookies permission + content_script on linkedin.com enables full session-cookie harvesting and profile scraping.
• Privacy policy fetched but scope_extension=false with data_collection=true and third_party_sharing=true — generic policy admitting data sharing.
• Operator cluster: sibling extension under same gmail fingerprint; low-accountability developer pattern.
• Free-webmail developer (jfl913@gmail.com) with no verified business; extension scrapes sensitive professional network data.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[linkedin], confirmed_owner=false, developer=gmail.
• cookies+linkedin_host manifest cookies permission paired with *://*.linkedin.com/* content_script; full session access to LinkedIn.
• privacy_policy_inadequate api scope_extension=false, data_collection=true, third_party_sharing=true; generic policy admits sharing without extension scope.
• operator_cluster api sibling_count=1 under same gmail fingerprint; sibling extension bdhcflkeglekljebdpanedpgeojpfefj.
• free_webmail_developer store Developer email jfl913@gmail.com; no verified business; numbered alias pattern (narutoapps913).
• no_csp manifest content_security_policy=null on MV3; no CSP declared.
• tos_violation_scraper store Extension title explicitly states 'Profile Scraper for LinkedIn' — scraping major platform violates ToS (v3.1 rule 7).
• privacy_policy_domain_mismatch api Developer email is gmail.com but privacy policy hosted on yueapps.uk; domain unverified, no business link.

Permissions Breakdown

• cookies high Can read/write cookies for all linkedin.com sessions; paired with broad host access amplifies exfil risk.
• storage low Local extension storage; no direct exfil risk on its own.
• identity medium Can access Google identity token; potential for account linkage or OAuth abuse.
• *://*.linkedin.com/* high Full content-script access to all LinkedIn pages; can read/scrape any profile, messages, connections.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• bdhcflkeglekljebdpanedpgeojpfefj

Bookkeeping