Top Risks

• cookies + webRequest + broad Amazon host access enables session-token observation on all Amazon storefronts
• declarativeNetRequestWithHostAccess allows request interception/redirect on Amazon pages
• Brand-mention flagged as impersonation (Amazon) but confirmed_owner=false; no verified-publisher badge
• No developer name listed in store; accountability gap for 4M-install extension
• Privacy policy lacks retention disclosure and is silent on third-party sharing

Evidence

• high_permissions_combo manifest cookies + webRequest + declarativeNetRequestWithHostAccess on 15 Amazon/keepa host patterns.
• brand_impersonation_flag api brand_mention.is_impersonation=true for 'amazon'; confirmed_owner=false; not verified publisher.
• install_url_hijack crx onInstalled opens https://keepa.com/#!manage — first-party domain, low severity.
• uninstall_url_hijack crx setUninstallURL to https://dyn-2.keepa.com/app/stats/?type=uninstall — own domain telemetry.
• no_csp manifest content_security_policy is null on MV3 extension; MV3 has strict defaults so no extra penalty.
• privacy_policy_gaps api Policy fetched, scoped, data_collection=true, but retention=false and third_party_silence=true.
• no_developer_name store developer_name is empty string; only email support@keepa.com available.
• featured_by_google store is_featured_by_google=true; positive trust signal for well-known price-tracker.

Permissions Breakdown

• alarms low Used for price-drop alert scheduling; low intrinsic risk.
• storage low Local data persistence for price history; standard low-risk.
• declarativeNetRequestWithHostAccess high Can block/redirect network requests on Amazon domains; significant capability.
• cookies high Read/write cookies; paired with Amazon host access could expose session tokens.
• contextMenus low Right-click menu additions; minimal risk.
• offscreen low Off-screen document for background processing; low-risk alone.
• webRequest high Observe all network requests to Amazon/keepa hosts; high observability risk.
• *://*.keepa.com/* medium Host access to own API domain; expected for price-tracker function.
• *://*.amazon.com/* (and 14 Amazon TLDs) high Full host access across all Amazon storefronts; broad scope on a major shopping site.

Pillar Scores

Bookkeeping