Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Brand impersonation: extension mentions 'Google' in name/description without being a verified Google product.
• Install-URL hijack: onInstalled opens focuscommit.com/google-calendar-guide (3rd-party marketing page).
• Content script injected into google-analytics.com domain — not justified by Pomodoro function.
• DOM innerHTML sink in React JSX runtime with no CSP in place (MV3 but no extension-level CSP declared).

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not FocusCommit's; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false, not verified_publisher, but is_featured_by_google=true → +1.0 reputation.
• install_url_hijack crx install_url_hijack=true targeting focuscommit.com/google-calendar-guide → +2.0 webstore.
• content_script_analytics_domain manifest content_scripts_matches includes *://www.google-analytics.com/* — no functional justification for a Pomodoro timer.
• dom_sink_innerhtml_userctrl crx innerHTML assignment in assets/js/jsx-runtime.462426cc.js; no CSP present → +2.0 code quality.
• monetization_google_analytics crx threat_intel.monetization_hits: www.google-analytics.com; telemetry-only tier → +1.0 webstore.
• no_csp manifest content_security_policy=null on MV3 extension; MV3 default is strict but no explicit extension-level policy declared.
• featured_badge store is_featured_by_google=true provides partial trust signal; not a verified publisher badge.

Permissions Breakdown

• storage low Local data persistence; low risk for a timer app.
• notifications low Used to alert Pomodoro intervals; expected for this category.
• content_scripts:*://calendar.google.com/* medium Script injection into Google Calendar; matches stated function but accesses page DOM.
• content_scripts:*://www.google-analytics.com/* medium Content script on analytics domain is unusual and not needed for Pomodoro functionality.

Pillar Scores

Bookkeeping