Top Risks

• Content script declared on <all_urls> — runs on every site visited despite only needing LinkedIn/Indeed/Lever/Greenhouse.
• Brand impersonation: mentions LinkedIn without confirmed ownership, flagged as impersonation.
• Privacy policy too short (405 chars), not scoped to extension, no retention disclosure — effectively inadequate.
• Stale update (15 months); invariant 0c caps verified-publisher discount due to months_since_update > 18 not met but 15mo is borderline.
• DOM-XSS sink (innerHTML from variable) with no CSP — elevated risk per FIX B rule.

Evidence

• content_scripts <all_urls> scope mismatch manifest content_scripts_matches includes <all_urls> but stated function is limited to 5 specific job-board domains.
• brand impersonation store brand_mention.is_impersonation=true for LinkedIn; confirmed_owner=false; developer_domain=resumary.com.
• privacy policy inadequate api Policy fetched; length=405; scope_extension=false, data_collection=false, retention=false — thin generic policy.
• DOM-XSS sink + no CSP crx innerHTML assigned from variable in popup.bundle.js; csp_present=false triggers FIX B +2.0 code quality uplift.
• maintenance staleness store Last updated March 2025; months_since_update=15 → +6.0 maintenance score (6-12 month band).
• verified publisher + featured store verified_publisher=true and is_featured_by_google=true; partial reputation discount applied.
• no developer name listed store developer_name is empty string; adds +1.0 to reputation pillar (no 'Offered by' name).
• no bad/affiliate/monetization hosts api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits; domain resolves and not throwaway.

Permissions Breakdown

• identity low OAuth token access; low risk without broad host perms but enables user-identity linkage.
• storage low Local extension storage only; standard low-risk permission.
• content_scripts: <all_urls> high Content script injected into all URLs despite stated function limited to job boards.

Pillar Scores

Bookkeeping