Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing.
• No developer display name in store; identity relies solely on email.
• clipboardRead permission could capture sensitive payment data from clipboard.
• No CSP declared; though MV3 applies defaults, absence is a minor hardening gap.
• Only 87 installs and no ratings — minimal community validation for a payment-related extension.

Evidence

• privacy_policy_generic store Privacy policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• verified_publisher store verified_publisher=true; developer email aklingspor@klingspor.com on resolving domain. Reputation -3.0 discount applied.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty.
• narrow_host_permissions manifest Host permissions limited to *.odoo.com and *.klingspor.com; matches stated MOTO payments function.
• no_cve_findings crx cve_findings_raw is empty; CVE pillar = 0.0.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty; code quality = 0.0.
• maintenance_active store Last updated January 22, 2026; months_since_update=5 → +1.5 maintenance.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; developer domain resolves, not throwaway.

Permissions Breakdown

• activeTab low Activates only on user gesture; limited scope.
• clipboardRead medium Can read clipboard content; potential data capture if abused.
• *://*.odoo.com/* low Scoped to odoo.com; matches stated payment function.
• *://*.klingspor.com/* low Scoped to developer's own domain; narrow.

Pillar Scores

Bookkeeping