Top Risks

• Privacy policy URL points to Chrome Web Store page, not a dedicated policy; third_party_sharing flagged without extension scope.
• manifest_source is html_fallback — no permissions, code, or manifest could be inspected; capability surface unknown.
• Developer name field is empty; eff.org domain is well-known but name absent from store listing.
• 1M installs increase blast radius if extension were ever compromised or transferred.
• Privacy policy lacks retention disclosure despite data scope and third-party sharing flags.

Evidence

• manifest_unavailable store manifest_source=html_fallback; js_files_scanned=0; permissions cannot be assessed.
• developer_identity store developer_email=extension-devs@eff.org; developer_name empty; eff.org resolves, not throwaway.
• featured_by_google store is_featured_by_google=true; reduces reputation risk.
• privacy_policy_url_generic store Privacy policy URL is own store listing page, not a dedicated policy doc.
• privacy_policy_classification api scope_extension=true, data_collection=false, third_party_sharing=true, retention=false.
• threat_intel_clean api bad_host_hits=[], affiliate_hits=[], monetization_hits=[], looks_throwaway=false.
• code_and_cve_clean crx code_findings_raw=[], cve_findings_raw=[], obfuscation_score=0.0.
• install_count store 1,000,000 installs; rating=4.5; review_red_flags match_count=0.

Permissions Breakdown

• permissions_unavailable low manifest_source is html_fallback; no permission data available to enumerate.

Pillar Scores

Bookkeeping