Top Risks

• cookies + declarativeNetRequestWithHostAccess on LinkedIn: can read session cookies and modify LinkedIn traffic.
• No CSP declared (MV3 default applies but csp_present==false); combined with DNRA raises interception risk.
• install_url_hijack: opens a URL on install — low severity but warrants review.
• developer_name missing in store listing reduces accountability; mitigated by verified_publisher.
• Third-party data sharing disclosed in privacy policy; retention policy present but sharing scope merits review.

Evidence

• verified_publisher store Developer is a verified publisher on Chrome Web Store; email matches trykondo.com domain.
• cookies+declarativeNetRequestWithHostAccess scoped to linkedin.com manifest High-capability permissions but constrained to https://*.linkedin.com/* only.
• install_url_hijack=true crx Extension calls onInstalled to open a URL; target not captured but is a minor trust signal.
• no_bad_hosts_no_cves api threat_intel bad_host_hits empty, cve_findings_raw empty, no monetization or affiliate hits.
• privacy_policy_adequate store Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• code_quality_clean crx 11 JS files scanned, obfuscation_score=0.0, code_findings_raw empty.
• content_scripts_include_localhost_and_pages_dev manifest Content scripts match localhost:5173 and kondo-*.pages.dev staging — development artifacts in prod manifest.
• maintenance_recent store Last updated April 2026 (4 months ago); active development cadence.

Permissions Breakdown

• cookies high Can read/write cookies; scoped only to linkedin.com via host_permissions, limiting blast radius.
• declarativeNetRequestWithHostAccess high Can intercept/block/redirect network requests on linkedin.com; powerful but scope-limited.
• storage low Standard local storage for extension state.
• alarms low Schedules background tasks; low direct risk.
• contextMenus low Adds right-click menu items; minimal risk.
• notifications low Sends desktop notifications; low risk in isolation.
• https://*.linkedin.com/* medium Host permission scoped to LinkedIn only; narrows cookies/DNRA exposure appropriately.

Pillar Scores

Bookkeeping