Top Risks

• Privacy policy fetched but admits data collection + 3rd-party sharing without scoping to this extension → Privacy pillar = 10.0
• Gmail-only developer identity, no business domain, no verified publisher badge → elevated Reputation risk
• install_url_hijack: onInstalled opens https://www.instagram.com/#asvo — install-redirect present
• No CSP + dom_sink_innerhtml_userctrl in content script running on Instagram — DOM-XSS exposure
• Google Analytics telemetry contact from an anonymous-story-viewer raises data minimisation concern

Evidence

• privacy_policy_admits_collection_and_3p_sharing_unscoped api Policy fetched (59k chars) but scope_extension=false, data_collection=true, third_party_sharing=true → D clause → +10.0 Privacy.
• free_webmail_dev_no_business_website store Developer email farukcepni@gmail.com; no developer_name; brand_mention.developer_domain=gmail.com; no business site.
• install_url_hijack crx install_url_hijack=true; target=https://www.instagram.com/#asvo — onInstalled opens 3rd-party URL (+2.0 Webstore).
• no_csp_plus_innerhtml_sink crx csp_present=false AND dom_sink_innerhtml_userctrl in cs_ui_loader.js & dashboard.js → +2.0 Code Quality (FIX B).
• monetization_hit_telemetry api www.google-analytics.com in monetization_hits (telemetry tier) → +1.0 Webstore.
• verified_publisher store verified_publisher=true; no stale/CVE/monetization triggers for 0c cap; full -3.0 Reputation discount applies.
• js_external_hosts_5_domains crx 5 external hosts: i.instagram.com, onlinetoolset.com, reactjs.org, www.google-analytics.com, www.instagram.com.
• cve_findings_empty api cve_findings_raw=[] → CVE pillar = 0.0.

Permissions Breakdown

• storage low Local state persistence only; standard for most extensions.
• alarms low Scheduling API; no data access.
• host_permissions: https://*.instagram.com/* medium Scoped to Instagram only; matches stated anonymous-story function.

Pillar Scores

Bookkeeping