Top Risks

• Uninstall URL hijack detected — redirects user to third-party page on removal, classic monetization shell signal.
• Install URL hijack opens aiadgenerator.app/welcome on install — typical affiliate/onboarding redirect pattern.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• No developer name listed, manifest uses placeholder i18n keys — low accountability and transparency.
• 24-month stale extension with no observable code risk surface; combined with install/uninstall URL hijacks raises concern.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set to third-party target — classic monetization shell indicator per rubric (+3.0 webstore).
• install_url_hijack crx onInstalled opens https://aiadgenerator.app/welcome — affiliate/onboarding redirect pattern (+2.0 webstore).
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• no_developer_name store developer_name is empty — +1.0 reputation for missing 'Offered by'.
• js_external_hosts crx External JS hosts: aiadgenerator.app, headlinegenerator.app — two distinct registrable domains outside store context.
• maintenance_stale store months_since_update=24; falls in 12-24mo band → +6.0 maintenance pillar.
• manifest_placeholder_name manifest manifest_name='__MSG_appName__' and manifest_description='__MSG_shortDesc__' — unpopulated i18n placeholders, low-effort manifest.
• no_verified_publisher_no_featured store verified_publisher=false, is_featured_by_google=false — no trust discounts applicable.

Pillar Scores

Bookkeeping