Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — InstaSkip [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• <all_urls> host permission vastly exceeds stated YouTube/Twitch/Spotify ad-skip function — scope mismatch.
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail), no developer name, no verified publisher — unverifiable identity.
• Brand impersonation: extension references YouTube, Twitch, Spotify brands without being affiliated.

Evidence

• scope_mismatch_all_urls manifest <all_urls> in host_permissions while content_scripts only target YouTube/Twitch/Spotify — excess reach.
• generic_google_privacy_policy store Privacy URL is Google's account privacy policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• free_webmail_no_dev_name store Developer email toyomii.official@gmail.com; developer_name is empty; no verified publisher badge.
• brand_impersonation store brand_mention.is_impersonation=true for YouTube, Twitch, Spotify; confirmed_owner=false.
• install_perm_anomaly api 8 installs with declarativeNetRequestWithHostAccess + <all_urls>; small_install_high_perm=true.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• js_external_hosts_anomaly crx js_external_hosts includes example.com and foo.bar — placeholder/test domains in production code.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — no code-level threats found.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — InstaSkip [adware] + malext.io malicious_extension_sentry; score 5.32 -> 7.82 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores extension settings locally; low risk.
• tabs medium Can read tab URLs and metadata; moderate surveillance potential.
• declarativeNetRequestWithHostAccess high Can intercept/block/redirect network requests across declared hosts including <all_urls>.
• https://youtube.com/* medium Content-script access to YouTube pages; matches stated function.
• https://*.youtube.com/* medium Broad YouTube subdomain access; matches stated function.
• https://youtube-nocookie.com/* low Embedded YouTube variant; matches stated function.
• https://*.youtube-nocookie.com/* low Embedded YouTube variant subdomain; matches stated function.
• https://twitch.tv/* medium Content-script access to Twitch; matches stated function.
• https://*.twitch.tv/* medium Twitch subdomain access; matches stated function.
• https://open.spotify.com/* medium Content-script access to Spotify; matches stated function.
• <all_urls> high Host permission extends far beyond stated YouTube/Twitch/Spotify scope — significant scope mismatch.

Pillar Scores

Bookkeeping