Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Content scripts run on <all_urls> enabling broad page-content access across all visited sites.
• Developer uses free webmail (gmail.com) with no verified business identity or developer name.
• Extension contacts api.openai.com — user input text is sent to OpenAI; no scoped data retention disclosed.
• Uninstall URL hijack flag set (uninstall_url_hijack=true); destination not captured but pattern is notable.

Evidence

• host_permissions=<all_urls>+content_scripts manifest Content scripts injected into all URLs; broad capability for an AI translation tool.
• privacy_policy_generic store Policy URL is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• developer_email_free_webmail store rxliuli@gmail.com with no developer_name and no business domain → elevated reputation risk.
• js_external_hosts crx Contacts api.openai.com, translate.google., react.dev — 3 distinct domains; user input sent to OpenAI.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; destination null in scan but flag is true.
• no_csp manifest MV3 extension with csp_present=false; default MV3 CSP applies but no custom restriction.
• verified_publisher+featured store verified_publisher=true and is_featured_by_google=true; partial trust signal, offset by webmail dev.
• is_ai_extension store Manifest description: 'Translate your input text with AI' — processes page input via OpenAI API.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local key-value storage; low risk.
• <all_urls> (host_permissions) high Content scripts injected into every site; broad read/write access to all page content.

Pillar Scores

Scoring History

Bookkeeping