Top Risks

• Privacy policy is generic Google account policy — not scoped to this extension; admits data collection and 3rd-party sharing (Privacy=10.0).
• Brand impersonation: 'gitlab' mentioned but developer is unverified gmail user with no confirmed ownership.
• Developer uses free webmail (gmail) with no business domain, elevating reputation risk.
• Three innerHTML DOM-XSS sinks found across side-panel JS files; no CSP present to mitigate.
• install_url_hijack flag is true — onInstalled may open a 3rd-party URL.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'gitlab'; developer is omarsarhan@gmail.com, confirmed_owner=false.
• free_webmail_developer store Developer email is omarsarhan@gmail.com (gmail); no business domain present.
• generic_privacy_policy store Privacy policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sinks crx 3 files contain innerHTML assignments from user-controlled variables; no CSP present to limit impact.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit restriction).
• install_url_hijack crx install_url_hijack=true; install_url_target=null (target not captured but flag set).
• featured_by_google store is_featured_by_google=true; partial positive signal but does not override impersonation/privacy concerns.
• no_host_permissions manifest host_permissions=[] and content_scripts_matches=[] — extension does not request broad site access.

Permissions Breakdown

• sidePanel low Shows a side panel UI; no data access on its own.
• storage low Local extension storage only; low standalone risk.

Pillar Scores

Bookkeeping