Top Risks

• Privacy policy URL returns SSL error (fetched=false) — policy unverifiable, treated as absent.
• innerHTML used with user-controlled data in sidepanel.js — DOM-XSS risk, no CSP to mitigate.
• Content scripts injected into all HTTP/HTTPS pages despite no CSP present (MV3 default applies).
• Very low install count (37) and no ratings — no community trust signal.
• Reputation score elevated: no verified publisher badge, small/new developer identity.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL SSL error on fetch; classified as fetched=false → +10.0 privacy pillar.
• dom_sink_innerhtml_userctrl crx sidepanel.js assigns innerHTML from variable; no CSP present — DOM-XSS sink elevated to +2.0.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• broad_content_scripts manifest content_scripts_matches covers http://*/* and https://*/* — all pages.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; reputation starts at 5.0.
• maintenance_6_12mo store months_since_update=11; falls in 6-12mo band → +3.5 maintenance.
• no_bad_hosts_no_monetization api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits — clean network.
• no_cve_findings crx cve_findings_raw is empty; no vulnerable libraries detected.

Permissions Breakdown

• activeTab low Grants access to the current tab only on user gesture; scoped and low blast radius.
• storage low Local data persistence for extension state; no cross-origin risk.
• contextMenus low Adds right-click menu items; no data exfil surface.
• scripting medium Can inject JS into pages; combined with broad content_scripts matches increases surface.
• sidePanel low UI panel only; no privileged data access.
• host_permission: https://www.rathsh.app/* low Scoped to developer's own domain only; expected for a CSS tool.
• content_scripts: http://*/* + https://*/* medium Broad injection into all pages; needed for CSS inspection but increases reach.

Pillar Scores

Bookkeeping