Top Risks

• Google generic privacy policy (scope_extension=false, admits data_collection+third_party_sharing) — scores maximum privacy risk.
• jquery-1.7 bundled: ancient library with function_constructor and dynamic script injection, no CSP to mitigate.
• Brand impersonation: 'YouTube' in name, developer is unverified gmail user with no business identity.
• Free-webmail developer (gmail), no verified publisher badge, no business domain — low accountability.
• No content_security_policy (MV3 default CSP only); dom_sink_innerhtml_userctrl amplified by absent CSP.

Evidence

• privacy_policy_generic store Policy is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• brand_impersonation store brand_mention.is_impersonation=true for 'youtube'; developer is gmail user, not verified → +2.0 reputation.
• free_webmail_developer manifest Developer email atnguyen4@gmail.com; no business website; no verified publisher → reputation floor 7.5.
• code_quality_findings crx script_src_dynamic + function_constructor in jquery-1.7.min.js; dom_sink_innerhtml_userctrl in inject.js; no CSP.
• no_csp manifest content_security_policy=null; csp_present=false. dom_sink_innerhtml_userctrl elevated to +2.0 per FIX B.
• ancient_jquery crx jquery-1.7.min.js detected (2011-era); contains new Function() and dynamic script creation patterns.
• network_hosts manifest 6 external JS hosts: last.fm, music.youtube.com, pajhome.org.uk, ws.audioscrobbler.com, www.last.fm, www.opensource.org.
• no_bad_hosts api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no threat-intel flags.

Permissions Breakdown

• storage low Stores local config/credentials; low standalone risk.
• host: http://ws.audioscrobbler.com/ medium Allows outbound API calls to Last.fm scrobble endpoint; narrow but network-capable.
• host: https://music.youtube.com/ medium Content-script access to YouTube Music tab; reads page content for track info.

Pillar Scores

Bookkeeping