Top Risks

• Privacy policy fetched but scope_extension=false AND data_collection=true AND third_party_sharing=true — policy admits broad data sharing without scoping to this extension.
• install_url_hijack and uninstall_url_hijack flags set; onInstalled/onUninstalled open 3rd-party URLs (targets null but flag is true).
• 12 distinct external JS hosts contacted including ipinfo.io, mixpanel analytics, and multiple uvw.workers.dev endpoints — broad network surface for a weather widget.
• Developer name field empty; no 'Offered by' display name despite verified publisher badge.
• No data retention disclosed in privacy policy despite confirmed data collection and third-party sharing.

Evidence

• privacy_policy_scope_mismatch api Policy fetched (35827 chars), data_collection=true, third_party_sharing=true, scope_extension=false, retention=false → D clause: +10.0.
• install_url_hijack crx install_url_hijack=true; target=null. Webstore +2.0 for onInstalled 3rd-party open.
• uninstall_url_hijack crx uninstall_url_hijack=true; target=null. Webstore +3.0 per rubric uninstall URL hijack signal.
• external_hosts_count crx 12 distinct registrable domains including mixpanel.com, ipinfo.io, api.ip.sb, multiple cloudflare workers. Network +1.5.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; Reputation discounts applied, floor at 2.0.
• developer_name_empty store developer_name is empty string; no 'Offered by' name visible. Reputation +1.0.
• no_cve_no_obfuscation crx cve_findings_raw=[], code_findings_raw=[], obfuscation_score=0.0. Code quality=0.0.
• host_geo_diversity api country_count=3 (CA,DE,US); below threshold of 4, no geo-diversity penalty.

Permissions Breakdown

• storage low Stores local prefs; low risk.
• alarms low Scheduled tasks; low risk.
• idle low Detects user idle state; low risk.

Pillar Scores

Scoring History

Bookkeeping