Top Risks

• YouTube brand impersonation by unverified gmail developer — confirmed_owner=false, is_impersonation=true
• Privacy policy fetched but scope_extension=false and data_collection=true: admits data collection without scoping to this extension (D rule → +10.0)
• Description promises download but 'downloads' permission absent — permission/description mismatch
• Free webmail developer (gmail) with no verified business website — classic throwaway pattern
• External JS host y2mate.technology not verified; ToS-violation risk (YouTube scraping/downloading)

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=['youtube'], confirmed_owner=false, developer_email=gmail.com
• privacy_policy_generic api Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=false → D rule +10.0
• description_permission_mismatch crx Promises download but lacks 'downloads' permission; description_promise.mismatches non-empty
• free_webmail_developer store developer_email=themfahad@gmail.com, developer_domain=gmail.com, no verified business
• external_js_host crx js_external_hosts=['y2mate.technology']; operator fingerprint includes this domain
• tos_violation_risk store VideoDownloader category + YouTube brand name = likely ToS-violation (v3.1 rule 7) +2.5
• no_csp crx content_security_policy=null; MV3 so no +2.0 MV2 penalty but CSP absent
• cve_findings_empty crx cve_findings_raw=[]; CVE pillar=0.0

Pillar Scores

Bookkeeping