Top Risks

• Privacy policy is for 'Shopify Shark' product, not this extension — admits data collection and 3rd-party sharing without extension-specific scope.
• Brand impersonation: Discord mentioned in name/description, developer is not affiliated with Discord Inc.
• Content script runs on all discord.com pages, capable of reading messages and session tokens.
• install_url_hijack flag is true — extension opens a URL on install (target unknown).
• new Function() constructor found in two JS files; no CSP present — dynamic code execution risk.

Evidence

• privacy_policy_mismatch store Policy URL path contains 'shopify-shark'; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for 'discord'; developer not confirmed owner; not verified_publisher.
• install_url_hijack crx install_url_hijack=true with null target; onInstalled opens 3rd-party URL — webstore +2.0.
• function_constructor_no_csp crx new Function() in dash/dash.js and pop/pop.js; csp_present=false → dynamic code execution possible.
• content_script_sensitive_origin manifest content_scripts_matches=[https://discord.com/*]; can access Discord messages and auth tokens.
• verified_publisher store verified_publisher=true but invariant 0c/0a: no stale/CVE/domain triggers; -3.0 applies to reputation.
• no_developer_name store developer_name is empty string; +1.0 reputation for missing 'Offered by' name.
• install_count_10k store 10,000 installs; +1.0 webstore reach signal.

Permissions Breakdown

• activeTab low Grants access to currently active tab only on user gesture; limited blast radius.
• storage low Local extension storage; no cross-origin data exposure.
• downloads medium Can write files to disk; used for export function but could be abused.
• scripting medium Programmatic script injection; higher risk when paired with content_scripts on sensitive origin.
• content_scripts:discord.com/* medium Runs in Discord pages; can read messages, tokens, and private content.
• host_permissions:hypercavs.com low Scoped to developer domain only; narrow host access.

Pillar Scores

Bookkeeping