[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

OpenAI Sora Video Downloader | Chrome Extension

Version 1.0.5 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Rating: 3.3 ★ (9 ratings)

Users: 4,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a concerning trust profile with only 4,000 users and a below-average rating of 3.3 from just 9 reviews. The lack of clear developer information and company details raises additional red flags. The extension claims to download videos from OpenAI's Sora platform, which is a legitimate use case, but the implementation appears overly broad.

Concerns:

- The tabs permission is excessive for a video downloader, allowing the extension to monitor and manipulate all browser tabs

- Host permissions extend beyond just Sora to include all ChatGPT domains and OpenAI sites, which is broader than necessary for the stated purpose

- The downloads permission, while expected for a downloader, combined with broad site access creates potential for unauthorized file downloads

- Low user adoption and poor ratings suggest possible functionality or security issues

- Missing developer information makes accountability difficult

Recommendations:

Consider running this extension in a separate Chrome profile to isolate potential risks from your main browsing session. Monitor your downloads folder for any unexpected files. Given the broad permissions and questionable trust indicators, you might want to look for alternative video downloading solutions with better security practices and developer transparency. If you must use this extension, disable it when not actively downloading Sora videos to minimize exposure.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "__MSG_extensionName__",
  "icons": {
    "16": "images/icon16.png",
    "48": "images/icon48.png",
    "128": "images/icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "images/icon16.png",
      "48": "images/icon48.png",
      "128": "images/icon128.png"
    },
    "default_popup": "popup.html"
  },
  "version": "1.0.5",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDescription__",
  "permissions": [
    "storage",
    "background",
    "downloads",
    "tabs"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "css": [],
      "run_at": "document_idle",
      "matches": [
        "https://www.openai.com/*",
        "https://openai.com/*",
        "https://sora.chatgpt.com/*",
        "https://*.chatgpt.com/*",
        "https://sora.chatgpt.com/g/*"
      ],
      "all_frames": false,
      "exclude_matches": [],
      "match_about_blank": false,
      "match_origin_as_fallback": false
    }
  ],
  "host_permissions": [
    "https://www.openai.com/*",
    "https://openai.com/*",
    "https://*.chatgpt.com/*",
    "https://sora.chatgpt.com/*",
    "https://sora.chatgpt.com/g/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://www.openai.com/*",
        "https://openai.com/*",
        "https://*.chatgpt.com/*",
        "https://sora.chatgpt.com/*",
        "https://sora.chatgpt.com/*"
      ],
      "resources": [
        "katex/*",
        "js/*",
        "fonts/*"
      ]
    }
  ]
}

by ✦ Astarte

OpenAI Sora Video Downloader | Chrome Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (8 total):

Raw Manifest

Detections

Manifest Findings

https://clients2.google.com/service/update2/crx	https://www.openai.com/
https://openai.com/	https://sora.chatgpt.com/
https://sora.chatgpt.com/g/	https://sora.chatgpt.com
https://sora.chatgpt.com/explore/videos	https://www.gotogpt4o.com/sora_downloader_feedback.html