Top Risks

• cookies + *://*/* host permission: full cookie exfil capability if compromised.
• Privacy policy fetched but admits data collection and 3rd-party sharing without extension-specific scope.
• jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); no CSP to mitigate XSS.
• Extension not updated in 23 months; approaching stale threshold with live CVEs.
• No developer display name; 10 external JS hosts including social networks beyond screenshot function.

Evidence

• cookies + *://*/* host perm manifest cookies permission paired with broad host access enables full cookie read/write on all sites.
• privacy policy scope mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic, not scoped to extension.
• jquery@3.2.1 CVEs crx 3 medium-severity XSS CVEs; fixed_in 3.5.0 not applied. No CSP to limit exploitation surface.
• no CSP + MV3 manifest content_security_policy is empty; MV3 default applies but jquery CVEs remain unmitigated.
• maintenance: 23 months store Last updated July 2024; 23 months since update with known unpatched CVEs.
• 10 external JS hosts crx Hosts include api.prntscr.com, upload.prntscr.com, plus social networks (vk.com, facebook.com, twitter.com, pinterest.com).
• description_promise mismatch store Promises recording but lacks tabCapture/desktopCapture permission — minor mismatch.
• verified_publisher true store skillbrains.com resolves; verified publisher; domain not throwaway. Reputation floor applied.

CVE Exposures (3)

Permissions Breakdown

• activeTab low Scoped to user-initiated action; expected for screenshot tool.
• storage low Standard settings/state persistence.
• unlimitedStorage low Plausible for local screenshot cache.
• notifications low Low-impact; used for capture confirmations.
• clipboardWrite medium Can write arbitrary content to clipboard; expected for screenshot copy.
• downloads medium Can save files to disk; expected for screenshot save.
• cookies high Full cookie access; combined with *://*/* host perm this is high-risk.
• *://*/* high Broad host access across all sites; amplifies cookies risk.

Pillar Scores

Scoring History

Bookkeeping