Top Risks

• Privacy policy admits data collection + third-party sharing but is not scoped to this extension (generic Firebase-hosted policy).
• YouTube brand impersonation by a gmail.com developer with no verified identity.
• Content script injected into developer's own web-app domain (ad-auto-skipper.web.app) alongside YouTube — dual-reach surface.
• DOM-XSS sink (innerHTML from variable) with no CSP present — exploit potential if content is attacker-influenced.
• 19 months since last update with 100K installs — stale extension with large blast radius.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[youtube]; developer is unverified gmail user.
• privacy_policy_generic_admits_sharing crx scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• content_script_extra_origin manifest content_scripts_matches includes ad-auto-skipper.web.app and localhost:5002 beyond primary YouTube scope.
• dom_xss_no_csp crx innerHTML sink in settings.js + csp_present=false → elevated code quality risk (FIX B).
• stale_extension_large_install store 19 months since update, 100K installs. Maintenance pillar +6.0.
• free_webmail_developer store developer_email=shreyadahal@gmail.com; no verified business; reputation floor applied.
• no_csp_mv3 manifest csp_present=false; MV3 has strict default but explicit CSP absent compounds innerHTML risk.
• js_external_host crx js_external_hosts=[ad-auto-skipper.web.app]; single US host, no bad-host/monetization hits.

Permissions Breakdown

• storage low Stores extension settings; no data exfil risk on its own.
• content_scripts *://*.youtube.com/* medium JS injected into all YouTube pages; can read/modify page content.
• content_scripts https://ad-auto-skipper.web.app/* medium Injects into developer's own Firebase-hosted domain — unusual scope.
• content_scripts http://localhost:5002/* low Localhost dev endpoint; low production risk but suggests debug artifact.

Pillar Scores

Bookkeeping