Top Risks

• Content scripts injected on all HTTP/HTTPS pages gives broad page-content access.
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• External JS host (us.i.posthog.com) indicates analytics telemetry sent to third party.
• No CSP declared (MV3 default applies, but no explicit policy); dynamic-loading risk not fully constrained.
• Developer name matches extension name; no verified publisher badge reduces accountability.

Evidence

• content_scripts_broad manifest content_scripts matches http://*/* and https://*/*, injecting on every site visited.
• privacy_policy_generic store Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• external_host_analytics crx js_external_hosts includes us.i.posthog.com (product analytics); outbound telemetry confirmed.
• no_csp manifest content_security_policy is null; csp_present=false. MV3 defaults apply but no explicit policy.
• not_verified_publisher store verified_publisher=false; developer name same as extension name; limited accountability.
• is_featured_by_google store is_featured_by_google=true; partial trust signal applied to Reputation.
• low_install_count store Only 332 installs; limited blast radius but reduces popularity-as-trust signals.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; no malicious code indicators detected.

Permissions Breakdown

• bookmarks medium Can read/write user bookmarks; moderate risk for a recipe-saving tool.
• storage low Local extension data storage; standard, low risk.
• content_scripts http://*/* https://*/* high Injects scripts on every HTTP/HTTPS page; broad reach even without host_permissions.

Pillar Scores

Bookkeeping