Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; data collection and 3rd-party sharing admitted without extension context.
• Brand impersonation: 'Spotify' mentioned, developer is unaffiliated gmail user (confirmed_owner=false).
• Gmail developer email with no business domain; no verified publisher badge.
• 17 months since last update (maintenance risk: stale but not critical).
• No CSP declared (MV3 mitigates but absence still noted alongside gmail dev identity).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[spotify], confirmed_owner=false, dev domain=gmail.com
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true
• free_webmail_developer store Developer email zopieux@gmail.com; no business domain; not a verified publisher
• featured_by_google store is_featured_by_google=true — reduces reputation risk but does not eliminate impersonation concern
• stale_extension store Last updated January 2025; months_since_update=17 — maintenance score elevated
• narrow_host_permissions manifest host_permissions restricted to https://open.spotify.com/ only; matches stated function
• no_bad_hosts_or_monetization api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no malicious network activity detected
• clean_code_scan crx code_findings_raw=[], obfuscation_score=0.0, cve_findings_raw=[] — no code-level threats found

Permissions Breakdown

• scripting medium Can inject JS into pages; scoped to open.spotify.com only — limited blast radius.
• storage low Local key-value storage; no cross-origin data exfil risk.
• https://open.spotify.com/ (host) low Single narrowly-scoped host matching stated function; not broad.

Pillar Scores

Bookkeeping