Top Risks

• Slack brand impersonation by unverified free-webmail developer with no developer name.
• webRequest permission allows interception of all Slack network traffic including auth tokens.
• No CSP + dom_sink_innerhtml_userctrl in two files raises DOM-XSS risk on Slack pages.
• LemonSqueezy payment API host_permission introduces third-party monetization surface.
• Small install count (357) with HIGH-tier permission is tail-attack-surface anomaly.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; Slack brand used, developer is gmail.com, confirmed_owner=false.
• free_webmail_dev_no_name manifest developer_email=lihster.developer@gmail.com; developer_name empty; no business website.
• webRequest_high_perm manifest webRequest declared with host_permissions *://*.slack.com/* enables full Slack traffic inspection.
• no_csp crx content_security_policy is null; MV3 has stricter defaults but extension CSP absent increases XSS risk.
• dom_xss_sinks crx Two innerHTML-from-variable findings in main.js and popup.js; no CSP mitigates.
• lemonsqueezy_host manifest host_permissions includes https://api.lemonsqueezy.com/v1/*; third-party payment/licensing API.
• small_install_high_perm api install_perm_anomaly.small_install_high_perm=true; 357 installs with webRequest HIGH permission.
• verified_publisher store verified_publisher=true; partially mitigates reputation risk but discounts capped due to monetization host.

Permissions Breakdown

• storage low Local key-value storage; no data leaves the device directly.
• webRequest high Can observe all network requests on matched hosts; intercept/inspect Slack API calls.
• *://*.slack.com/* medium Scoped to Slack only; matches stated function but enables full DOM+network access on Slack.
• https://api.lemonsqueezy.com/v1/* medium Payment/licensing API endpoint; third-party network access for monetization.

Pillar Scores

Bookkeeping