Top Risks

• Content scripts injected on all HTTP/HTTPS sites — broad surface despite no declared permissions[].
• Developer uses free Gmail address; developer domain dskl.net unverified, no business identity.
• Extension last updated 21 months ago; approaching abandonment/acquisition risk window.
• No CSP declared (MV3 mitigates somewhat but adds +2.0 Network for MV2-style absence on broad host).
• Privacy policy does not disclose data retention; third-party sharing status unclear.

Evidence

• broad_content_scripts manifest content_scripts_matches=['http://*/*','https://*/*'] — injects into every page visited.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• gmail_developer store developer_email=dskloet@gmail.com; free webmail, no verified business identity.
• is_featured_by_google store Extension carries Google Featured badge — reduces but does not eliminate trust concerns.
• stale_extension store months_since_update=21; in 6-24mo band (+6.0 maintenance pillar).
• privacy_policy_retention_missing api Policy fetched; scope_extension=true, data_collection=false, retention=false, third_party_silence=true.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0; 1 JS file scanned, no malicious indicators.
• no_cve_findings crx cve_findings_raw=[]; no known-vulnerable libraries detected.

Permissions Breakdown

• content_scripts: http://*/* https://*/* high Broad content script injection on all HTTP/HTTPS pages; runs code in every site context.

Pillar Scores

Bookkeeping