Top Risks

• Privacy policy URL not fetchable (HTTP error) — policy content unverifiable.
• Developer uses free webmail (gmail) with no verified business identity.
• Manifest source is html_fallback — permissions and code not directly inspectable.
• No permissions visible; extension surface area is opaque, not confirmed clean.
• Small install base (2,000) with unverified developer reduces accountability.

Evidence

• privacy_policy_fetch_error api Privacy policy URL returned HTTPError; content could not be classified. Treated as fetched==false => +10.0 privacy.
• manifest_source_html_fallback store Manifest parsed from HTML fallback; permissions/content_scripts not directly observed. 0 JS files scanned.
• developer_identity store Developer email is thestarkings@gmail.com (free webmail), no verified publisher badge, no business domain.
• is_featured_by_google store Extension carries Google Featured badge, providing moderate legitimacy signal.
• no_threat_intel_hits api No bad_host_hits, affiliate_hits, or monetization_hits detected in threat_intel.
• no_cve_findings api cve_findings_raw is empty; no library CVEs detected.
• no_code_findings crx code_findings_raw is empty; obfuscation_score=0.0; 0 JS files scanned (CRX not available).
• recently_updated store Last updated April 23, 2026 — months_since_update ~0; maintenance risk negligible.

Pillar Scores

Bookkeeping