Top Risks

• Privacy policy does not scope to this extension and admits third-party sharing; classified scope_extension=false.
• Developer name absent; identity relies solely on zendesk support subdomain.
• Four distinct external JS hosts in fingerprint (Dropbox, html-cleaner, toolset.pkstate.com, gmass.co) — surface not visible in CRX scan.
• Rating of 3.1 on a low-install base suggests user dissatisfaction; no review red flags confirmed.
• Verified publisher discount applies but 0c cap not triggered; privacy policy gap remains primary residual risk.

Evidence

• verified_publisher store Extension carries verified publisher badge; reputation discount applied but capped due to privacy policy gap.
• privacy_policy_scope api Policy fetched; scope_extension=false, data_collection=false, third_party_sharing=true → +9.0 privacy pillar.
• js_external_hosts crx 4 external hosts in CSP fingerprint: dl.dropboxusercontent.com, html-cleaner.com, toolset.pkstate.com, www.gmass.co.
• csp_present_mv3 manifest CSP: script-src 'self'; object-src 'self'. MV3 + strict CSP; no MV2 penalty.
• no_developer_name store developer_name is empty string; identity only via support@gmass.zendesk.com.
• low_rating store Rating 3.1 on 7,000 installs; no review red flags matched in automated scan.
• code_findings_empty crx code_findings_raw=[]; obfuscation_score=0.0; no malicious code signals detected.
• maintenance store Last updated December 2025; months_since_update=6 → +1.5 maintenance score.

Permissions Breakdown

• declarativeNetRequest medium Blocks network requests declaratively; appropriate for tracker-blocking function.
• storage low Local config/state storage; minimal risk.
• declarativeNetRequestFeedback low Read-only feedback on blocked requests; low risk.
• notifications low User-facing alerts only; no data exfil vector.

Pillar Scores

Bookkeeping