Top Risks

• Default search engine hijacked to copilsearches.com/api.copilsearches.com — all user queries routed to unknown third party.
• Privacy policy is only 62 characters, not scoped to this extension, and doesn't mention data collection or retention.
• Developer name is blank; extension title mimics Chrome™ branding creating potential impersonation confusion.
• No JS code observable (0 files scanned) — extension's entire function is search redirection with no auditable logic.
• Verified publisher status combined with deceptive search override and inadequate privacy policy warrants manual review.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing all searches to api.copilsearches.com — not the developer's own domain.
• privacy_policy_trivially_short api Privacy policy fetched but only 62 chars; scope_extension=false, data_collection=false — effectively a placeholder.
• developer_name_missing store developer_name is empty string; extension name includes Chrome™ trademark without verified Google affiliation.
• search_endpoint_mismatch manifest Developer domain is smartaisearching.com but search URLs point to copilsearches.com — different registrable domain.
• verified_publisher store verified_publisher=true; provides partial reputation credit but does not explain search-domain mismatch.
• no_js_files crx js_file_count=0, js_files_scanned=0 — extension has no auditable JS; entire function is manifest-level search redirect.
• installs_elevated store 60,000 installs means search-redirect reaches substantial user base, amplifying data-collection impact.
• third_party_silence api third_party_silence=true in privacy classification; policy does not address data sharing despite routing queries externally.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) high Silently replaces the user's default search engine with copilsearches.com, a third-party domain.

Pillar Scores

Bookkeeping