Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing: scores maximum privacy risk.
• Three innerHTML DOM-XSS sinks across content/popup/options scripts with no CSP; elevated under FIX B.
• install_url_hijack flagged true; onInstalled opens a third-party URL adding webstore risk.
• brand_mention.is_impersonation=true for YouTube; developer is not YouTube/Google (mitigated by verified+featured).
• No CSP on MV3 extension with DOM sinks; any XSS in server-returned segment data could escalate.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com — Google's own account policy, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• dom_sink_innerhtml_no_csp crx 3 files contain innerHTML sinks; csp_present=false triggers FIX B escalation to +2.0 per instance; capped at 4.0 code quality.
• install_url_hijack crx install_url_hijack=true; target=null so destination unknown. Adds +2.0 webstore.
• brand_impersonation_mitigated store YouTube mentioned in name; is_impersonation=true but verified_publisher+is_featured → +1.0 reputation (v3.2 rule 9).
• verified_publisher_featured store verified_publisher=true + is_featured_by_google=true; reputation floor=2.0 applied.
• host_permissions_scoped manifest host_permissions limited to youtube.com and sponsor.ajay.app; justified-broad discount applied to permissions pillar.
• no_cve_no_bad_hosts api cve_findings_raw empty; bad_host_hits empty; monetization_hits empty; affiliate_hits empty.
• recently_updated_active store months_since_update=2; maintenance score=0.0.

Permissions Breakdown

• storage low Local data persistence for skip segments; expected for this category.
• scripting medium Allows JS injection into pages; scoped to YouTube only via host_permissions.
• unlimitedStorage low Extended storage for segment database; low standalone risk.
• https://*.youtube.com/* medium Host access scoped to YouTube; matches stated function.
• https://sponsor.ajay.app/* low Dev-controlled API endpoint for segment data; narrow and expected.

Pillar Scores

Bookkeeping