Top Risks

• Free-webmail dev (gmail) with no verified business; unverifiable identity for extension with broad host access.
• Privacy policy is Google's own generic policy — does not scope to this extension, admits data collection and 3rd-party sharing.
• <all_urls> + scripting + declarativeNetRequestWithHostAccess: can read/modify every page and intercept all network requests.
• dom_sink_innerhtml_userctrl in reader.js with no CSP: DOM-XSS risk on page content injected into every site.
• Only 3 installs with high-tier permissions: tail-attack-surface risk; low scrutiny, easy to weaponize after update.

Evidence

• free_webmail_dev_no_business store Developer email hunkiepeanut.dev@gmail.com; no business domain; unverifiable identity.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_policy_classification_admits_collection_sharing api scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy posture.
• broad_host_access_with_high_permissions manifest <all_urls> paired with scripting + declarativeNetRequestWithHostAccess; can read/modify all web traffic.
• dom_xss_sink_no_csp crx reader.js: innerHTML assigned from variable with csp_present=false; DOM-XSS exploitable via page content.
• install_perm_anomaly api Only 3 installs with high-tier permissions; small_install_high_perm=true; minimal public scrutiny.
• js_external_hosts_suspicious crx js_external_hosts includes example.com and foo.bar — placeholder/test domains unlikely in production.
• no_verified_publisher_no_featured store Not verified publisher, not featured by Google; no trust signals beyond listing presence.

Permissions Breakdown

• storage low Local state persistence; limited risk alone.
• activeTab medium Access to current tab on user action; scoped but enables page reading.
• scripting high Programmatic script injection into pages; high capability when paired with <all_urls>.
• downloads medium Can write files to user's disk; matches stated Markdown-download function.
• declarativeNetRequestWithHostAccess high Can intercept and modify network requests across all URLs; significant capability.
• <all_urls> (host_permissions) high Broad host access amplifies scripting and declarativeNetRequestWithHostAccess risk.
• <all_urls> (content_scripts) high Content scripts injected on every page; persistent access to all page content.

Pillar Scores

Bookkeeping