Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Developer uses free Gmail address with no verified business domain, reducing accountability.
• Extension last updated 14 months ago; no active maintenance signal.
• No content security policy declared (MV3 so no +2 network penalty, but adds minor risk).
• Low install base (3 000) with unverifiable developer identity raises tail-attack-surface concern.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.
• developer_email_free_webmail store Developer email timegonedev@gmail.com — free webmail, no business website → Reputation +1.5.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false — no trust discounts available.
• maintenance_stale store months_since_update=14; falls in 12-24mo band → Maintenance +6.0.
• no_csp crx content_security_policy=null; MV3 so no +2 network penalty, but absence noted.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty — no malicious indicators.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; search_engine_count=0.
• permissions_narrow manifest Only contextMenus+scripting+activeTab; no host_permissions; matches word-counter use-case.

Permissions Breakdown

• contextMenus low Adds right-click menu; matches stated word-counter function.
• scripting medium Allows script injection into active tab; scoped by activeTab so limited.
• activeTab low Grants transient access to current tab only on user interaction.

Pillar Scores

Bookkeeping