Top Risks

• Free-webmail dev (wl.exten.06@gmail.com) with WhatsApp brand impersonation confirmed.
• Privacy policy fetched but not scoped to this extension and data_collection=false — generic policy.
• Content script on WhatsApp Web DOM with innerHTML sink — XSS risk to conversation data.
• install_url_hijack opens web.whatsapp.com on install; minor redirect signal.
• No CSP on MV3; dom_sink_innerhtml_userctrl present — elevated DOM-XSS exposure.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain is gmail.com, not Meta/WhatsApp.
• free_webmail_dev store Developer email wl.exten.06@gmail.com is free-webmail with numbered alias; no verified business domain.
• privacy_policy_generic api Policy fetched (hiperchat.com.br) but scope_extension=false, data_collection=false — not scoped to RoboZapp.
• dom_xss_sink crx innerHTML from variable in vendor.DzFEYc3-.js; no CSP to mitigate DOM-XSS on WhatsApp Web.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — minor redirect, not a 3rd-party ad URL.
• content_script_sensitive_domain manifest Content script injected into https://web.whatsapp.com/* — accesses WhatsApp conversation DOM.
• js_external_hosts crx External hosts: hc-stt.hiperchat.com.br (dev-controlled), reactjs.org (CDN docs page), web.whatsapp.com.
• very_low_installs store Only 13 installs; extension is nascent and unproven — limited trust basis.

Permissions Breakdown

• unlimitedStorage low Allows unrestricted local storage; low risk for a WhatsApp automation tool.
• storage low Standard key-value storage; no cross-origin concern.
• tabs medium Can read tab URLs and titles; moderate risk without broad host perms.
• alarms low Scheduling only; no data-access risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify conversation DOM.

Pillar Scores

Bookkeeping