Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Description promises website blocking but lacks webRequest/declarativeNetRequest permissions — description-permission mismatch.
• No developer display name on listing; reduces accountability signal.
• tinyurl.com referenced in external JS hosts — shortened URL introduces destination opacity.
• No CSP defined (MV3 default applies, but explicit policy absent).

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 D).
• description_mismatch store promises.block=true but no declarativeNetRequest/webRequest declared → +2.0 Webstore.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true → Reputation discounts applied, floor 2.0.
• tinyurl_external_host crx tinyurl.com in js_external_hosts; shortened URL destination unverifiable, minor network concern.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit policy. No CVEs so no amplifier triggered.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0 — code quality clean.
• no_bad_hosts_affiliates api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no threat intel hits.
• maintenance_current store months_since_update=0, last_updated=June 11 2026 — actively maintained.

Permissions Breakdown

• storage low Stores timer/block-list settings locally; standard for productivity tools.
• alarms low Schedules Pomodoro intervals; expected for a timer extension.
• notifications low Fires desktop alerts at interval end; expected function.
• tabs medium Can read tab URLs to apply website blocking; medium because URL enumeration possible.

Pillar Scores

Bookkeeping