Top Risks

• Generic Google privacy policy admits data collection & 3rd-party sharing without scoping to extension
• Broad <all_urls> host access with scripting capability
• 19 months since last update (abandonment risk)
• Free Gmail developer account with no business website
• MV3 extension with no Content Security Policy

Evidence

• privacy_policy_generic api Privacy policy is generic Google policy (myaccount.google.com), not scoped to extension, admits data collection and 3rd-party sharing
• broad_host_access manifest Requests <all_urls> host_permissions with scripting permission, enables arbitrary content injection
• maintenance_stale store Last updated March 2025, 19 months ago, indicates potential abandonment
• free_webmail_developer store Developer uses Gmail (coolcursorsproject@gmail.com) with no verified business domain
• no_csp_mv3 manifest MV3 extension without Content Security Policy header (csp_present=false)
• featured_by_google store Extension has 'Featured by Google' badge (is_featured_by_google=true)
• external_js_react crx References react.dev in external JS hosts
• no_code_findings crx No obfuscation, remote code loading, or suspicious API usage detected in code scan

Permissions Breakdown

• storage low Local data storage only, standard permission
• scripting medium Can inject scripts on <all_urls> via broad host permissions
• <all_urls> (host_permissions) high Broad host access enables content injection on all visited sites

Pillar Scores

Bookkeeping