Top Risks

• <all_urls> host permission + scripting enables full page read/write on every site user visits.
• AI extension processes page content and sends it to monica.im — high-value exfil surface.
• No CSP declared (MV3 default helps, but no explicit policy); innerHTML sinks present without CSP hardening.
• Developer name field empty in listing; reduces accountability signal.
• 3M+ install base amplifies any future compromise or policy change.

Evidence

• host_permissions <all_urls> + scripting manifest Extension injects content scripts on every URL; high capability surface for AI data processing.
• AI category + broad host access store Webstore +2.5 AI/Gen-AI extension processing page content; justified-broad discount applied (-1.5).
• dom_sink_innerhtml_userctrl (2 files) crx innerHTML sinks in content.js and monicaPopup.js; no CSP present → FIX B triggers +2.0 code quality.
• csp_present == false, MV3 manifest No explicit CSP; MV3 provides strict default so no +2.0 network penalty, but amplifies innerHTML risk.
• privacy_policy scoped with retention and third-party sharing api Policy fetched, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true → +1.0.
• is_featured_by_google == true store Featured badge provides -2.0 reputation discount; not verified publisher so cap rules don't apply.
• domain_age_ct age_days=1207, cert_count=188 api Domain ~3.3 years old, not new, no domain-age penalty.
• threat_intel clean api No bad_host_hits, affiliate_hits, or monetization_hits; developer domain resolves, not throwaway.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• scripting medium Allows dynamic script injection into pages; elevated when paired with <all_urls>.
• sidePanel low UI surface only; no direct data-access capability.
• contextMenus low Adds right-click menu items; minimal risk surface.
• <all_urls> (host_permissions) high Grants content-script access to every site user visits; broad reach for an AI extension.

Pillar Scores

Scoring History

Bookkeeping