Top Risks

• Privacy policy is a generic freeprivacypolicy.com template: admits data collection and third-party sharing without scoping to this extension.
• Developer identity is a free Gmail account (puneeth00748@gmail.com) with no verified business presence.
• Brand impersonation signal: extension name/description prominently references 'Stackoverflow' without confirmed ownership.
• AI extension sends page/question content to an external HuggingFace Space endpoint with no CSP or auditable data-handling commitment.
• Maintenance boundary: 12 months since last update places extension at the 6-12 month stale band.

Evidence

• privacy_policy_generic_admits_sharing api Policy fetched from freeprivacypolicy.com; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• free_webmail_developer store Developer email puneeth00748@gmail.com; no business domain; reputation floor triggered at 7.5.
• brand_impersonation store brand_mention.is_impersonation=true, brands=['stackoverflow'], confirmed_owner=false, not verified/featured → +2.0 reputation.
• ai_extension_external_endpoint manifest AI category; sends SO question data to HuggingFace Space. No CSP. +2.5 webstore AI signal.
• no_csp_mv3 crx content_security_policy=null; MV3 default applies but no explicit CSP raises code-quality and network concerns.
• maintenance_stale_6_12mo store months_since_update=12; falls in 6-12 month band → +3.5 maintenance pillar.
• no_bad_hosts_no_affiliates api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no malicious network signals.
• zero_installs_zero_rating store install_count unparsed (empty string); rating=0; very low blast radius but also unvetted by community.

Permissions Breakdown

• host_permissions: https://puneeth00748-automated-tagging-browser-extension.hf.space/* low Scoped to single dev-controlled HuggingFace Space endpoint; matches stated ML-tagging function.

Pillar Scores

Bookkeeping