Top Risks

• Brand impersonation: uses Spotify™ trademark in name/title; developer is unaffiliated gmail user with no business identity.
• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection + 3rd-party sharing) — counts as worse-than-no-policy under v3.5 rules.
• External JS host sweetalert2.github.io loaded at runtime with no CSP; github.io CDN could serve arbitrary JS to Spotify pages.
• Free-webmail developer (gmail) with no verified business identity raises accountability and future-sale risk.
• webRequest on Spotify origin with no CSP allows potential request interception/modification of Spotify session traffic.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false; developer_domain is gmail.com, not spotify.com.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• external_js_host_no_csp crx js_external_hosts includes sweetalert2.github.io; csp_present=false; remote code could be loaded with no integrity check.
• free_webmail_developer store developer_email=tomer8007@gmail.com; no business website; no verified publisher badge.
• webrequest_permission manifest webRequest declared; host scoped to open.spotify.com/* only — justified for ad-blocking category.
• no_csp_mv3 manifest content_security_policy=null; MV3 has strict default but external host contacts add network risk.
• no_bad_hosts_or_cves crx cve_findings_raw=[], bad_host_hits=[], code_findings_raw=[]; no active malicious signals detected.
• obfuscation_clean crx obfuscation_score=0.0; all 7 JS files scanned with no suspicious findings.

Permissions Breakdown

• webRequest high Can observe and intercept all network requests on matched hosts; core ad-blocking capability but high-risk permission.
• host_permissions: https://open.spotify.com/* medium Scoped to Spotify Web Player only; limits blast radius but grants full request/content access on that origin.
• content_scripts: https://open.spotify.com/* medium Injects JS into Spotify pages; scoped narrowly but can read/modify all page content and DOM on that site.

Pillar Scores

Bookkeeping