Top Risks

• No developer name, email, or install/update metadata — unverifiable identity and zombie-extension risk.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Maintenance unknown: months_since_update is null with MV2; likely long-abandoned or never properly published.
• MV2 with no CSP adds +2.0 network risk per v2 calibration rule.
• Extension has no JS files and no observable functionality — may be a stub or placeholder shell.

Evidence

• no_developer_identity store developer_name, developer_email, and installs all missing — unverifiable publisher.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; scope_extension=false, data_collection=true, third_party_sharing=true.
• mv2_no_csp manifest Manifest version 2 with content_security_policy=null triggers +2.0 network penalty per v2 calibration.
• no_js_files crx js_file_count=0 and js_files_scanned=0 — extension has no executable JS; appears to be a shell.
• maintenance_unknown store months_since_update is null; MV2 extension with no update data treated as worst-case stale.
• reputation_no_identity store No developer name, no email, no verified publisher badge, no featured badge — start 5.0 +1.0 (no dev name) +1.5 (no business site implied) =7.5 floored at 7.5.
• narrow_host_permission manifest Single permission: http://flacherbauchbuch.blogspot.com — low risk, narrow single-site host.
• no_cve_findings crx cve_findings_raw is empty; CVE pillar = 0.0.

Permissions Breakdown

• http://flacherbauchbuch.blogspot.com low Single narrow host permission to a blogspot URL; low capability, narrow scope.

Pillar Scores

Bookkeeping