Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• brand_mention flags 'github' as impersonation; developer is not a confirmed GitHub org owner.
• No CSP declared (MV3 default mitigates but absence still noted).
• install_count at 10,000 threshold adds modest blast-radius signal.
• domain_age_ct query timed out — cert age unverifiable, minor residual uncertainty.

Evidence

• privacy_policy_generic store Policy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.0.
• brand_impersonation store brand_mention.is_impersonation=true for 'github'; confirmed_owner=false; not verified publisher nor featured-discounted enough to suppress.
• featured_by_google store is_featured_by_google=true applies -2.0 reputation discount.
• narrow_host_permission manifest host_permissions=['https://github.com/'] and content_scripts scoped to github.com/* only.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[] — clean code surface.
• no_cve_findings crx cve_findings_raw=[] — no vulnerable bundled libraries detected.
• threat_intel_clean api bad_host_hits=[], affiliate_hits=[], monetization_hits=[]; developer domain resolves, not throwaway.
• install_count_threshold store installs=10,000 triggers +1.0 webstore blast-radius signal.

Permissions Breakdown

• storage low Stores local settings/preferences; no cross-origin data exposure.
• host_permission: https://github.com/ low Narrowly scoped to GitHub only; matches stated visualization function.
• content_scripts: https://github.com/* low Content script restricted to GitHub pages; aligns with stated purpose.

Pillar Scores

Bookkeeping