Top Risks

• Privacy policy is Google's generic account policy, not scoped to this extension — admits data collection and 3rd-party sharing.
• Developer is an unverified free-webmail account (gmail) with numeric alias; no business identity.
• Very low install count (27) with no ratings; unproven, no community vetting.
• No CSP declared (MV3 default applies, but raises code-quality observability gap).
• 3–6 months since last update; mildly stale but not critical.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection=true, third_party_sharing=true.
• free_webmail_numeric_dev store Developer email aa01201399880@gmail.com is a numeric-alias free-webmail address with no business website.
• narrow_host_permissions manifest Host permissions limited to api.open-meteo.com and geocoding-api.open-meteo.com; matches weather widget purpose.
• no_bad_hosts_or_affiliates api threat_intel shows no bad_host_hits, no affiliate_hits, no monetization_hits.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; single JS file scanned with no suspicious patterns.
• low_install_count store Only 27 installs, 0 ratings — no community signal to calibrate trust.
• maintenance_3_6mo store Last updated December 15, 2025; 6 months since update — borderline stale.
• no_cve_findings crx cve_findings_raw is empty; no bundled vulnerable libraries detected.

Permissions Breakdown

• storage low Stores user preferences/city locally; no cross-site data risk.
• https://geocoding-api.open-meteo.com/* low Narrow host permission to open-meteo geocoding API; matches stated function.
• https://api.open-meteo.com/* low Narrow host permission to open-meteo weather API; matches stated function.

Pillar Scores

Bookkeeping