Top Risks

• Extension abandoned: 46 months since last update (>36mo), zombie-level staleness.
• Privacy policy is Google's generic account policy — scope_extension=false, data_collection=true, third_party_sharing=true; worst-case classification triggers +10.0.
• eBay brand impersonation: developer is unverified gmail user, confirmed_owner=false.
• Free-webmail developer (gmail) with no business domain raises accountability concerns.
• Featured badge present but stale+impersonation combination limits trust discount.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'ebay'; developer is christensen143@gmail.com, confirmed_owner=false.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → D-clause +10.0.
• maintenance_zombie store Last updated August 2022; months_since_update=46, >36mo stale with 1,000 installs.
• free_webmail_developer manifest Developer email christensen143@gmail.com; no business domain, no verified publisher.
• featured_badge store is_featured_by_google=true; applies -2.0 reputation discount but stale+impersonation limits full trust benefit.
• no_cve_no_code_findings crx cve_findings_raw=[], code_findings_raw=[], obfuscation_score=0.0; single JS file, clean scan.
• no_bad_hosts api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] all empty.
• mv3_no_csp manifest MV3 with no explicit CSP; MV3 has strict default so no +2.0 network penalty applies.

Permissions Breakdown

• contextMenus low Adds right-click menu items; core stated function, no data access.

Pillar Scores

Bookkeeping