Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension at all (admits data collection + 3rd-party sharing).
• Brand impersonation: 'YouTube' in title by unverified gmail developer with no ownership claim.
• Extension stale 25 months; zombie window for silent re-acquisition or silent payload change.
• Free-webmail developer (gmail) with no verified business identity or domain.
• No CSP on MV3 extension; content script runs on all YouTube pages with no script constraint.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'YouTube' brand used by alistairdev6@gmail.com, confirmed_owner=false.
• generic_privacy_policy store Policy is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true). Triggers +10.0 privacy.
• free_webmail_developer manifest Developer email alistairdev6@gmail.com; no business domain, no verified publisher badge.
• stale_extension store Last updated May 2024; months_since_update=25, exceeds 24-month zombie threshold.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit hardening declared.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; js_external_hosts empty. Clean scan.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty. No operator siblings.
• youtube_host_permission manifest content_scripts_matches and host_permissions both scoped to https://*.youtube.com/* only.

Permissions Breakdown

• storage low Stores user settings locally; limited scope, no cross-site risk.
• host: https://*.youtube.com/* medium Content script runs on all YouTube pages; can read/modify page content including account data.

Pillar Scores

Bookkeeping