Top Risks

• Privacy policy fetch failed — treated as no policy; data handling completely opaque for 2M users.
• Brand impersonation: title/description references YouTube, ChatGPT, Claude, Gemini without being their official publisher.
• content_scripts declared on <all_urls> — extension injects into every site despite narrow stated function.
• function_constructor (new Function) usage detected in code — dynamic code execution risk.
• Uninstall URL hijack detected — redirects users on removal to a third-party destination.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (fetch_error:HTTPError) → Privacy pillar scored +10.0.
• brand_impersonation store brand_mention.is_impersonation=true; brands: youtube, claude, gemini, chatgpt; not verified publisher, not confirmed owner.
• content_scripts_all_urls manifest <all_urls> in content_scripts_matches grants broad page access beyond stated YouTube/AI-chat scope.
• uninstall_url_hijack crx uninstall_url_hijack=true — extension registers a third-party uninstall redirect URL.
• function_constructor crx new Function() detected in get-current-media-c64f214e.js — dynamic code execution capability.
• ai_extension_page_content store AI extension processing page content (YouTube transcripts, web articles) for 2M users; high data-exposure surface.
• no_developer_name store developer_name is empty string; identity relies solely on email hi@glasp.co.
• is_featured_by_google store Extension carries Google Featured badge, partially mitigating reputation concerns.

Permissions Breakdown

• storage low Used to persist user preferences and summaries locally.
• content_scripts:<all_urls> high <all_urls> content script injection grants read/modify access to every page the user visits.

Pillar Scores

Bookkeeping