Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, admits data collection and 3rd-party sharing) — scores maximum privacy risk.
• Developer uses free webmail (gmail.com) with no verified business domain, reducing accountability.
• Content scripts injected on <all_urls> means extension runs on every page visited, including sensitive sites.
• js_external_hosts list includes 10 domains (example.com, github.com, etc.) — purpose unclear but no bad-host hits found.
• Not a verified publisher; no business domain to verify developer identity.

Evidence

• privacy_policy_generic store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Developer email bartekplus@gmail.com; no business domain; domain_age_ct not queried (free webmail).
• content_scripts_all_urls manifest content_scripts_matches=[<all_urls>]; extension can read/modify DOM on every site.
• is_featured_by_google store Google Featured badge present; partially offsets reputation risk.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; no eval, exfil, or dynamic loading detected.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries bundled.
• external_hosts crx 10 js_external_hosts including example.com variants and github.com; no bad/monetization/affiliate hits in threat_intel.
• csp_present_mv3 manifest CSP set: script-src 'self' 'wasm-unsafe-eval'; MV3 with self-only scripts; no remote code loading.

Permissions Breakdown

• storage low Stores user preferences/autocomplete data locally; low risk.
• activeTab low Access limited to currently active tab on user action; low risk.
• content_scripts:<all_urls> medium Injects scripts on all sites; necessary for universal autocomplete but broadens attack surface.

Pillar Scores

Bookkeeping