Top Risks

• Brand impersonation: extension mentions 'claude' brand without verified ownership by Anthropic.
• Privacy policy is Google's generic policy — scope_extension=false, third_party_sharing=true; does not describe this extension's data handling.
• webRequest over api.anthropic.com and claude.ai allows interception of user prompts and auth tokens.
• raw.githubusercontent.com host permission enables remote config/code fetching (supply-chain risk).
• Uninstall URL hijack detected (uninstall_url_hijack=true); could redirect users to 3rd-party page on removal.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'claude'; developer is lugia19, not Anthropic; no verified publisher badge.
• privacy_policy_generic_google api Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• webRequest_sensitive_hosts manifest webRequest declared with host_permissions including api.anthropic.com/* and claude.ai/*; can read prompts/tokens.
• remote_host_github_raw manifest host_permission https://raw.githubusercontent.com/* allows fetching arbitrary remote content at runtime.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension sets an uninstall redirect URL to a 3rd-party destination.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in content-components/length_ui.js; no CSP present — elevated XSS risk.
• no_csp manifest content_security_policy=null on MV3 extension; no explicit CSP hardening despite DOM-sink finding.
• high_install_count store 90,000 installs increases blast radius if any vulnerability is exploited.

Permissions Breakdown

• storage low Stores usage tracking data locally; expected for this function.
• alarms low Periodic checks for usage caps; low risk.
• webRequest high Can observe all network requests matching host_permissions; monitors API calls to claude.ai and api.anthropic.com.
• tabs medium Can read tab URLs and titles; needed to detect active claude.ai tabs.
• contextMenus low Adds right-click menu items; low risk.
• notifications low Alerts user on usage cap events; low risk.
• *://claude.ai/* medium Host permission scoped to claude.ai only; matches stated function.
• https://raw.githubusercontent.com/* medium Broad GitHub raw access enables remote config/code fetch; supply-chain risk.
• https://github.com/* medium Wide GitHub access; potentially for update checks or config.
• https://api.anthropic.com/* medium Can intercept or observe Anthropic API calls including auth tokens.

Pillar Scores

Bookkeeping