Top Risks

• Privacy policy is a generic Google account policy (fetch error/not scoped), not specific to this extension.
• Free-webmail Gmail developer with no verified identity or business website.
• No content_security_policy declared (MV3 default applies, but no explicit CSP).
• Very low install count (27) limits confidence in community vetting.
• External JS host reference to github.com; not fetched at runtime but warrants note.

Evidence

• privacy_policy_not_scoped api Privacy policy URL is Google's own account policy; fetch failed (SSLError); scope_extension=false. Scores +9.0 privacy pillar.
• free_webmail_developer store Developer email dhamiabhishek3496@gmail.com is Gmail; no verified publisher badge; no business domain.
• narrow_host_permissions manifest Host permissions limited to adobe.com subdomains matching stated Adobe Analytics export function.
• no_cve_findings crx cve_findings_raw is empty; no vulnerable libraries detected.
• no_code_findings crx code_findings_raw is empty; obfuscation_score=0.0; single JS file scanned.
• external_js_host_github crx js_external_hosts lists github.com; no dynamic remote loading found in code_findings_raw.
• recently_updated store months_since_update=1; maintenance pillar score 0.0.
• no_operator_siblings api operator_cluster.sibling_count=0; no cluster risk.

Permissions Breakdown

• activeTab low Grants access only to the current tab on user gesture; scoped and transient.
• scripting medium Allows injecting scripts into pages; combined with activeTab keeps scope narrow.
• https://experience.adobe.com/* low Narrow host permission scoped to Adobe Analytics domain matching stated function.
• https://*.an.adobe.com/* low Narrow host permission scoped to Adobe Analytics API subdomain; fits stated export function.

Pillar Scores

Bookkeeping