Top Risks

• Privacy policy fetched but scope_extension==false and data_collection==true: policy admits collection without scoping to this extension.
• Brand impersonation flag: 'twitter' mentioned; confirmed_owner==false, though verified publisher and featured mitigate.
• No CSP on MV3 extension; dynamic script element creation in content.js raises minor DOM-injection concern.
• Developer name field empty; soitis.dev resolves and email matches domain, but no display name reduces accountability.
• Install count 300K on twitter.com content scripts; high reach if extension is ever compromised or transferred.

Evidence

• privacy_policy_generic api Policy fetched (434 chars), scope_extension=false, data_collection=true, third_party_sharing=false. Admits collection without extension-specific scope → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for 'twitter'; confirmed_owner=false. Verified+featured apply v3.2 rule: +1.0 reputation.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reputation discounts applied, floor 2.0.
• script_src_dynamic crx content.js creates <script> element dynamically. Snippet shows type='text/json' for settings injection, not remote src load.
• no_csp manifest content_security_policy=null on MV3; v2 calibration fix (b) does not add penalty for MV3 but noted.
• high_install_reach store 300K installs with content scripts on twitter.com/x.com; high blast radius if future compromise.
• no_bad_hosts_no_monetization api threat_intel: bad_host_hits=[], affiliate_hits=[], monetization_hits=[]; no network threat signals.
• cve_findings_empty crx cve_findings_raw=[]; no known vulnerable libraries detected.

Permissions Breakdown

• storage low Stores extension settings locally; no data exfiltration risk on its own.
• content_scripts: twitter.com/x.com/mobile variants medium Runs JS on all Twitter/X pages; scoped to stated function but broad within that domain.

Pillar Scores

Bookkeeping