Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Brand impersonation: mentions GitHub and Google without verified ownership; dev is free-webmail gmail account.
• 12 external JS hosts including third-party domain stuartk.com; broad network surface for a developer tool.
• Extension last updated 15 months ago; no verified publisher; gmail developer with no business domain.
• new Function() constructor in bundled diff2html lib introduces code-execution risk if inputs are attacker-controlled.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands: github, google; developer domain is gmail.com, confirmed_owner=false.
• generic_privacy_policy store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — D clause applies (+10.0).
• free_webmail_developer store Developer email leonhartx.k@gmail.com; no verified publisher badge; no business website; domain_age_ct queried=false.
• external_host_diversity crx 12 distinct external hosts including stuartk.com, stuk.github.io, citeseerx.ist.psu.edu; 3 countries (CA, IN, US).
• function_constructor crx new Function() in lib/diff2html.min.js; CSP is present and strict (script-src 'self'), limiting runtime exploit surface.
• maintenance_stale store 15 months since last update; MV3 but in 6-12mo band for maintenance scoring.
• no_bad_hosts_or_monetization api threat_intel: bad_host_hits=[], affiliate_hits=[], monetization_hits=[]; operator sibling_count=0.
• content_script_scoped manifest content_scripts_matches limited to https://script.google.com/*; matches stated function as GAS editor integration.

Permissions Breakdown

• identity low OAuth token access; no scopes declared; low standalone risk for a GitHub integration tool.
• storage low Local extension storage only; standard low-risk permission.
• host: https://script.google.com/* medium Content script injected into Google Apps Script editor; scoped to single origin, matches stated function.

Pillar Scores

Bookkeeping