Top Risks

• Brand impersonation: mentions 'google' in name/description but developer is unaffiliated browsecraft.com.
• Privacy policy not scoped to this extension and omits data retention details.
• Developer name field empty; reduces accountability signal.
• Privacy policy third-party sharing status unclear (third_party_silence=true).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'google' referenced but confirmed_owner=false, developer is browsecraft.com.
• verified_publisher store Extension carries verified publisher badge; caps reputation discount per rules.
• privacy_policy_not_scoped api scope_extension=false, data_collection=false → +9.0 privacy score (generic policy, no extension scope).
• third_party_silence api third_party_silence=true adds +1.0 to privacy pillar; policy silent on 3rd-party sharing.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty; no malicious indicators.
• cve_clean crx cve_findings_raw empty; jquery 3.6.0 detected but no known CVEs flagged.
• narrow_permissions manifest Only identity+storage+googleapis.com host; minimal surface, consistent with stated Google Drive sync.
• no_bad_hosts api threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty; developer domain resolves.

Permissions Breakdown

• identity medium OAuth token access; needed for Google Drive sync but allows identity correlation.
• storage low Local extension storage; low risk, standard use.
• https://www.googleapis.com/ medium Host permission scoped to Google APIs only; appropriate for Drive sync function.

Pillar Scores

Bookkeeping