Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, admits data_collection+third_party_sharing) — worst-case privacy signal, score +10.0.
• Content scripts injected on 35 major search engine domains (Google.*, Bing, DuckDuckGo) without broad host_permissions declared — elevated reach.
• install_url_hijack flagged true; onInstalled may open third-party URL.
• No CSP declared (MV3 so no v2 penalty, but combined with content-script reach warrants note).
• Developer name field empty; only email identity available.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's generic policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• content_scripts_broad manifest Content scripts declared on 35 search-engine origins (google.*, bing.com, duckduckgo.com) — high REACH despite low permissions.
• install_url_hijack crx install_url_hijack=true; target null in data. Extension opens a URL on install — unverified destination.
• verified_publisher store verified_publisher=true with webfuse.com resolving; partially offsets reputation concern.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — clean code surface.
• js_external_host crx Single external JS host: webfuse.com (developer-owned domain, resolves=true).
• maintenance_6_12mo store Last updated June 2025; months_since_update=12 — borderline 6-12 month band (+3.5).

Permissions Breakdown

• contextMenus low Adds right-click menu entries; standard for link-anonymizing tools.
• storage low Persists user settings locally; low impact.
• activeTab low Accesses current tab only on user gesture; scoped access.

Pillar Scores

Bookkeeping