Top Risks

• Brand impersonation: YouTube mentioned as brand without confirmed ownership.
• Privacy policy fetched but scope_extension=false and only 276 chars; effectively a stub policy.
• No CSP declared (MV3 mitigates but uninstall URL hijack flag is set).
• External hosts include www.paypal.com and www.googleapis.com — payment + auth surface with no policy disclosure.
• Developer name blank; identity accountability limited to email only.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'youtube'; confirmed_owner=false.
• privacy_policy_stub crx Policy fetched but length=276 chars, scope_extension=false, data_collection=false; treated as generic/stub.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag raised by scanner.
• external_hosts_breadth crx 8 external hosts including paypal.com, googleapis.com, addons.mozilla.org, svelte.dev.
• no_developer_name store developer_name is empty string; only email hello@clarify-ai.org available.
• no_csp manifest content_security_policy=null; MV3 default mitigates eval but no explicit CSP declared.
• verified_publisher store verified_publisher=true; domain clarify-ai.org resolves, not throwaway.
• cve_findings_empty crx cve_findings_raw=[]; no vulnerable bundled libraries detected.

Permissions Breakdown

• background low Keeps service worker alive; low standalone risk.
• storage low Local key-value storage; no data exfil by itself.
• identity medium Can request OAuth tokens; scope depends on usage.
• *://*.youtube.com/* (host) medium Content script on YouTube only; matches stated function but grants page-content read.

Pillar Scores

Bookkeeping