Top Risks

• Content script declared with <all_urls> despite stated function targeting only eBay pages — unnecessary broad reach.
• Brand impersonation: extension name prominently uses 'eBay' but developer is unaffiliated (gmail dev, no dev name).
• Developer identity: no developer name, gmail-only contact; free-webmail signals elevated anonymity risk.
• Privacy policy discloses third-party data sharing with zikanalytics.com; retention acknowledged but third-party scope unclear.
• Extension contacts api.zikanalytics.com and www.zikanalytics.com — third-party analytics domain not clearly disclosed in store listing.

Evidence

• content_scripts_broad manifest content_scripts_matches includes <all_urls> alongside specific eBay patterns; stated function is eBay-only.
• brand_impersonation store brand_mention.is_impersonation=true for 'ebay'; developer is gmail user with no verified affiliation.
• free_webmail_dev_no_name store developer_email=doingaff@gmail.com, developer_name empty; no business identity verifiable.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; reduces reputation risk but does not eliminate brand concern.
• third_party_analytics_hosts crx js_external_hosts includes api.zikanalytics.com and www.zikanalytics.com — third-party service endpoints.
• privacy_policy_third_party_sharing api privacy_policy_classification: scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• description_shell_pattern store description_promise.is_shell_pattern=true; minimal stated functionality relative to broad content-script injection.
• no_csp manifest csp_present=false on MV3; default MV3 CSP applies but no explicit extension CSP hardening.

Permissions Breakdown

• storage low Stores local extension state; no cross-site data exfil risk on its own.
• content_scripts:<all_urls> high Broad content-script match includes <all_urls> alongside specific eBay patterns; overly broad.

Pillar Scores

Bookkeeping