Top Risks

• Privacy policy does not scope data collection to this extension (data_collection=true, scope_extension=false) — privacy pillar at maximum.
• Brand impersonation: 'google' mentioned without confirmed ownership or verified publisher status.
• Install URL hijack on onInstalled → tasksboard.com/signIn; uninstall URL → third-party Google Forms survey.
• No developer name listed; reduces accountability signal for 500K-install extension.
• MV3 no CSP; minor risk given narrow host permissions but noted for completeness.

Evidence

• privacy_policy_scope_fail api Policy fetched (20965 chars), data_collection=true, scope_extension=false, third_party_silence=true → +10.0 privacy (D-path).
• brand_impersonation store brand_mention: brands=['google'], is_impersonation=true, confirmed_owner=false, not verified_publisher → +2.0 reputation.
• install_url_hijack crx onInstalled opens https://tasksboard.com/signIn (3rd-party redirect) → +2.0 webstore.
• uninstall_url_hijack crx setUninstallURL to forms.gle/SZznd2XAiPu4s4qJ9 → +3.0 webstore per rubric.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true → reputation discounts applied; cap checked.
• no_developer_name store developer_name is empty string; identity anchored only to contact@tasksboard.app.
• no_cve_no_code_findings crx cve_findings_raw=[], code_findings_raw=[], obfuscation_score=0.0 → pillars 6&8 at 0.
• installs_500k_high_reach store 500,000 installs → +1.0+1.0 webstore reach; privacy gap affects large user base.

Permissions Breakdown

• sidePanel low Displays content in the Chrome side panel; limited blast radius.
• contextMenus low Adds right-click menu items; minimal capability.
• host:https://tasksboard.com/* low Scoped to developer-owned domain only; narrow surface.
• host:http://localhost/* low Localhost access for dev/debugging; low production risk.

Pillar Scores

Bookkeeping