Top Risks

• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing true: admits broad data collection without scoping to this extension (→ +10 privacy).
• Brand impersonation: mentions 'chatgpt' without being verified owner; not featured by Google (→ +2 reputation).
• Three innerHTML DOM-XSS sinks across contentScript, popup, and AI content injector with no CSP — attacker-controlled AI responses could trigger XSS.
• Broad host_permissions covering 10+ major AI platforms (ChatGPT, Claude, Gemini, Copilot/M365, Grok, DeepSeek, Perplexity) — high-value conversation data reachable.
• No developer name listed; policy on agatsoftware.com domain does not scope to this extension; AI extension processing page content on sensitive enterprise AI surfaces.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[chatgpt], confirmed_owner=false, not featured.
• privacy_policy_unscoped_with_collection_and_sharing api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → D-clause +10.0.
• dom_xss_sinks_no_csp crx 3 innerHTML sinks in contentScript/popup/AIProtectorGemini with csp_present=false; FIX B applies → +2.0 each capped.
• broad_ai_platform_host_permissions manifest 20 host_permission entries covering ChatGPT, Claude, Gemini, Copilot/M365, Grok, DeepSeek, Perplexity, Falcon LLM.
• ai_extension_page_content store Category=Security/AI; content_scripts injected into all major AI platforms; AI/Gen-AI extension processing page content.
• no_developer_name store developer_name='' — no 'Offered by' name present; developer_email agatsaas@agatsolutions.com.
• verified_publisher store verified_publisher=true; domain resolves, not throwaway; no monetization/affiliate hits — partial discount applies.
• external_js_hosts crx js_external_hosts: app.pragatix.ai, pragatix.com, training.knowbe4.com, www.youtube.com, grok.com, chatgpt.com, chat.falconllm.tii.ae (7 hosts).

Permissions Breakdown

• storage low Local config/state storage only; low intrinsic risk.
• host_permissions: *://*.chatgpt.com/* + *://*.chat.openai.com/* high Full read/write access to ChatGPT sessions — can read prompts and responses.
• host_permissions: *://*.claude.ai/* + *://*.gemini.google.com/* + *://*.grok.com/* high Broad access to multiple AI platforms; can exfiltrate sensitive AI conversations.
• host_permissions: *://*.copilot.microsoft.com/* + *://*.m365.cloud.microsoft/* high Access to Microsoft 365/Copilot — enterprise data exposure risk.
• host_permissions: *://agatsoftware.com/* + *://*.agatsoftware.com/* medium Developer-owned backend; data could be sent to vendor servers.
• host_permissions: *://*.chat.deepseek.com/* + *://*.deep-seek.chat/* medium Access to DeepSeek AI chats; sensitive conversation data reachable.
• host_permissions: *://*.www.perplexity.ai/* medium Access to Perplexity AI sessions.
• host_permissions: *://chat.falconllm.tii.ae/* medium Access to Falcon LLM platform; non-standard origin.

Pillar Scores

Bookkeeping