Top Risks

• Privacy policy fetched but not scoped to this extension; admits data collection and third-party sharing — worst-case privacy posture.
• TikTok brand mention without confirmed ownership — possible brand impersonation risk.
• 22 months since last update; extension may be abandoned and unmaintained.
• Content scripts injected into TikTok seller portals can access order and account data; outbound calls to hubfulfill.com observed.
• Only 14 installs; low visibility makes malicious behaviour harder to detect via community review.

Evidence

• privacy_policy_generic api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• brand_impersonation store brand_mention.is_impersonation=true for 'tiktok'; developer_domain hubfulfill.com is not confirmed TikTok owner → +2.0 reputation.
• stale_extension store months_since_update=22; maps to 12-24mo band → +6.0 maintenance.
• content_scripts_tiktok_seller manifest Content scripts on seller-uk.tiktok.com/* and seller-us.tiktok.com/*; JS outbound to hubfulfill.com.
• no_csp manifest csp_present=false; MV3 has strict default so no additional network penalty applied per v2 rule (b).
• no_bad_hosts_or_monetization api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty; domain resolves and not throwaway.
• operator_cluster_solo api sibling_count=0; no cluster risk.
• low_install_count store Only 14 installs; no community trust signal; install_perm_anomaly flags not triggered.

Permissions Breakdown

• storage low Local data persistence only; no cross-origin or user-data exfil risk on its own.
• content_scripts: https://seller-uk.tiktok.com/* medium Injects JS into TikTok seller portal; can read order/account data on those pages.
• content_scripts: https://seller-us.tiktok.com/* medium Same as above for US seller portal; scope is narrow but targets sensitive commerce pages.

Pillar Scores

Bookkeeping