Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• clipboardRead with content_scripts on all URLs means every keystroke-copied secret is accessible on every site visited.
• No CSP present (MV3 strict default applies, but broad host injection with no explicit policy increases attack surface).
• Developer uses free-webmail (protonmail) with no verifiable business domain; accountability is low.
• Uninstall URL hijack flag set (uninstall_url_hijack=true) — may redirect users to 3rd-party page on removal.

Evidence

• clipboardRead + all-URL content_scripts manifest clipboardRead permission combined with content_scripts on http://*/* and https://*/* — reads clipboard on every site.
• No content security policy crx csp_present=false; no explicit CSP defined in manifest for MV3 extension.
• Privacy policy is Google account policy store URL points to myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• Uninstall URL hijack crx uninstall_url_hijack=true; extension registers an uninstall URL redirect to an unknown 3rd-party target.
• Free webmail developer email store Developer email is fullmetal_answering_machine@protonmail.com — no verifiable business domain.
• Featured by Google store is_featured_by_google=true; partial trust signal, reduces reputation risk somewhat.
• No bad hosts / CVEs / obfuscation crx cve_findings_raw empty, bad_host_hits empty, obfuscation_score=0.0, code_findings_raw empty.
• Maintenance: 17 months since update store Last updated January 2025; 17 months stale falls in 12-24mo band (+6.0 maintenance score).

Permissions Breakdown

• storage low Stores clipboard history locally; expected for this extension type.
• clipboardRead high Reads clipboard content on all pages via broad content_scripts; core clipboard-manager function but high sensitivity.
• content_scripts http://*/* https://*/* high Broad injection on every page amplifies clipboardRead risk; no CSP limits what injected code can do.

Pillar Scores

Bookkeeping