Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension at all; data_collection + third_party_sharing flagged.
• install_url_hijack + uninstall_url_hijack both true; install/uninstall redirects indicate monetization or tracking intent.
• Developer email is free-webmail (yahoo.com) with no verified business identity; no verified publisher badge.
• 11 external JS hosts including mths.be, mathiasbynens.be, webextension.org — high host geo-diversity (3 countries) without VPN/network category justification.
• Stale: 20 months since last update; is_featured_by_google but discount capped due to staleness (>18mo) per v3.5 invariant 0c.

Evidence

• install_url_hijack crx install_url_hijack=true; target null but flag set — onInstalled opens 3rd-party URL pattern.
• uninstall_url_hijack crx uninstall_url_hijack=true; chrome.runtime.setUninstallURL() to 3rd party — +3.0 webstore.
• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Developer email chyer.webstore@yahoo.com; free webmail, no verified business, no verified publisher badge.
• stale_update store Last updated Oct 2024; 20 months since update → maintenance +6.0. Featured but discount capped at -1.0 (>18mo stale).
• external_hosts_count crx 11 distinct external JS hosts incl. mths.be, mathiasbynens.be, webextension.org; 3 geo countries (IN, NL, US).
• declarativeNetRequestWithHostAccess manifest HIGH permission with scoped host access to wunderground.com and api.weather.com; intercept capability present.
• operator_cluster_dev_email_count api dev_email sibling_count=1 by email dimension; compound=0; no sibling extensions under same fingerprint.

Permissions Breakdown

• declarativeNetRequestWithHostAccess high Can intercept and block/redirect network requests on matched hosts — HIGH capability.
• storage low Local data persistence; standard low-risk permission.
• alarms low Scheduling; low risk on its own.
• idle low Detects user idle state; low risk.
• contextMenus low Adds right-click menu items; low risk.
• *://www.wunderground.com/* (host) medium Scoped host access; paired with declarativeNetRequestWithHostAccess raises intercept risk on this domain.
• *://api.weather.com/* (host) medium Scoped host access to weather API; paired with declarativeNetRequestWithHostAccess.

Pillar Scores

Bookkeeping