Top Risks

• WhatsApp message content can be read and routed to 6+ external AI APIs including unmanifested api.deepseek.com and api.x.ai
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10.0)
• Brand impersonation: uses WhatsApp brand while developer domain is gmail.com, not Meta/WhatsApp (+2.0 reputation)
• Free-webmail developer (gmail) with no business name or website; verified_publisher flag insufficient given other signals
• Install URL hijack opens web.whatsapp.com on install; minor UX manipulation signal

Evidence

• privacy_policy_generic_google store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.0
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true, confirmed_owner=false, developer_domain=gmail.com → Reputation +2.0
• free_webmail_no_dev_name store developer_email=watoolsmarketing@gmail.com, developer_name=''; free-webmail dev floor applies → Reputation floor 7.5
• ai_extension_multi_api manifest 7 distinct AI API host_permissions; js_external_hosts includes api.deepseek.com and api.x.ai not in host_permissions
• content_script_whatsapp manifest content_scripts on web.whatsapp.com — can read all WhatsApp DOM including messages
• install_url_hijack crx install_url_hijack=true, target=https://web.whatsapp.com → Webstore +2.0
• dom_xss_sink crx innerHTML from variable in content.js; csp_present=true and no other eval finding → Code Quality +0.5 base, csp present limits amplifier
• verified_publisher_low_signal store verified_publisher=true but free-webmail, no dev name, generic policy — floor rules dominate; discount capped at -1.0 per v3.5(E)

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• activeTab medium Access to current tab on user action; bounded scope.
• identity low OAuth token access; scoped to user-consented flows.
• alarms low Background scheduling only; no data access.
• notifications low System notifications; low risk.
• unlimitedStorage low Extended local storage quota; no exfil risk alone.
• host: https://web.whatsapp.com/* high Content script on WhatsApp — can read messages and DOM.
• host: https://wasubo.com/* + https://v3.wasubo.com/* medium Dev-controlled backend; data routing to unverified domain.
• host: https://api.openai.com/* medium Sends content to OpenAI; user data leaves browser.
• host: https://api.anthropic.com/* medium Sends content to Anthropic; same exfil surface.
• host: https://generativelanguage.googleapis.com/* medium Sends content to Google Gemini API.
• host: https://api.cohere.ai/* medium Sends content to Cohere; additional AI data sink.
• host: https://api.groq.com/* medium Sends content to Groq; additional AI data sink.
• host: https://api.mistral.ai/* medium Sends content to Mistral; additional AI data sink.

Pillar Scores

Bookkeeping