Top Risks

• Privacy policy URL is inaccessible (fetch error); effectively no privacy disclosure exists.
• Free webmail developer (gmail) with no verified business identity raises accountability concerns.
• Content scripts injected on <all_urls> can read DOM of every visited page.
• No CSP defined; MV3 mitigates somewhat but adds no additional constraint.
• No install count available; blast radius unknown but reputation unestablished.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL returned HTTPError; policy content unverifiable — treated as no policy.
• free_webmail_developer store Developer email emmanuelakyeam@gmail.com; no business domain or verified publisher status.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; extension can inject into every page visited.
• no_csp manifest content_security_policy is null; no explicit CSP declared (MV3 has default restrictions).
• no_bad_hosts_or_monetization api threat_intel shows empty bad_host_hits, monetization_hits, affiliate_hits.
• clean_code_scan crx code_findings_raw empty, obfuscation_score 0.0, 3 JS files scanned — no malicious signals.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.
• operator_cluster_singleton api sibling_count 0; no coordinated extension cluster detected under this developer fingerprint.

Permissions Breakdown

• activeTab low Accesses current tab only on user action; limited scope.
• storage low Local extension data storage; standard low-risk permission.
• alarms low Schedules periodic tasks; no data exfil risk alone.
• tabs medium Can read tab URLs/titles across browser; moderate info exposure.
• host_permission: https://www.googleapis.com/pagespeedonline/v5/runPagespeed low Single scoped API endpoint; narrow and matches stated function.
• content_scripts: <all_urls> medium Content script runs on all pages; can read DOM on every visited site.

Pillar Scores

Bookkeeping