Top Risks

• Privacy policy admits data collection and third-party sharing without scoping to this extension — scored 10.0.
• clipboardRead captures all copied content including passwords and sensitive data; stored externally via api.instantdb.com.
• DOM-XSS innerHTML sinks in popup and sign-in pages with no CSP; clipboard data could be rendered unsafely.
• Developer uses Gmail address with no verified business identity; no developer name listed.
• No CSP declared (MV3 mitigates slightly) but external hosts api.instantdb.com and www.instantdb.com contact real backend.

Evidence

• privacy_policy_scope_mismatch api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• gmail_developer_no_name store developer_email=andyluyoung@gmail.com, developer_name empty; free-webmail dev raises reputation risk.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; discounts applied to reputation pillar.
• dom_xss_innerHTML_no_csp crx Two innerHTML user-controlled sinks in popup and sign-in JS; csp_present=false amplifies DOM-XSS risk.
• external_backend_instantdb crx js_external_hosts includes api.instantdb.com and www.instantdb.com; clipboard data may sync to external service.
• cve_findings_empty crx No CVEs detected in bundled libraries; cve_pillar_score=0.0.
• no_bad_hosts_monetization api bad_host_hits, affiliate_hits, monetization_hits all empty; operator sibling_count=0.
• recently_updated store months_since_update=0; maintenance pillar=0.0.

Permissions Breakdown

• storage low Standard key-value storage for clipboard history.
• offscreen low Used to access clipboard APIs in a hidden document context.
• clipboardRead medium Core function but reads all clipboard content including sensitive data.
• clipboardWrite medium Can inject content into clipboard; moderate risk if misused.
• unlimitedStorage low Allows storing large clipboard history; low standalone risk.
• contextMenus low Adds right-click menu items; minimal risk.
• scripting medium Can inject scripts into pages; scope limited by activeTab here.
• activeTab low Scoped to user-activated tab only; limits blast radius.
• sidePanel low UI surface only; no data-access risk on its own.

Pillar Scores

Bookkeeping