Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to this extension.
• Brand impersonation: 'github' mentioned in name/brand_mention but developer is unaffiliated gmail user.
• Free-webmail developer (gmail.com) with no verified business identity or website.
• No CSP declared (MV3 mitigates somewhat, but no explicit policy).
• Tiny install base (5 users) with broad content_script host pattern *://*/*/pull/* beyond just github.com.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands=['github'], confirmed_owner=false, dev domain=gmail.com
• generic_privacy_policy store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true
• free_webmail_developer store Developer email sangsoo.ted@gmail.com; no business domain or verified publisher badge.
• content_scripts_broad manifest content_scripts_matches includes *://*/*/pull/* and *://*/pulls* beyond github.com only.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP declared.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts, 2 JS files scanned.
• no_bad_hosts api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] all empty.
• low_install_count store Only 5 installs, 0 ratings; no operator siblings; recently updated May 2026.

Permissions Breakdown

• content_scripts *://*/*/pull/* medium Injects scripts into GitHub PR pages; scoped narrowly to pull-request URLs.
• content_scripts *://github.com/pulls low Limited to github.com pulls listing; very narrow scope.

Pillar Scores

Bookkeeping