[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

TubeX.Chat: YouTube AI智能体

Version 3.3.1 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Developer: tubex.chat

Rating: 4.4 ★ (29 ratings)

Users: 4,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 4 total findings, including 2 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://translate.googleapis.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
webRequest

Host Permissions:

https://www.youtube.com/*
https://translate.googleapis.com/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (191 total):

https://tubex.chat	https://www.youtube.com/api/timedtext?
https://dashscope.aliyuncs.com/compatible-mode/v1/chat/completions	https://open.bigmodel.cn/api/paas/v4/chat/completions
https://api.moonshot.cn/v1/chat/completions	https://wanqing.streamlakeapi.com/api/gateway/v1/endpoints/chat/completions
https://generativelanguage.googleapis.com/v1beta/models/	https://translate.googleapis.com/translate_a/single?client=gtx&sl=auto&tl=
https://www.youtube.com/watch?v=5aOkIauvsow	https://www.youtube.com/watch?v=a3EH4VmxMAo
https://clients2.google.com/service/update2/crx	https://www.youtube.com/
https://translate.googleapis.com/	https://en.wikipedia.org/wiki/Base64#URL_applications
https://github.com/beatgammit/base64-js/issues/42	https://www.w3.org/TR/xml/#dt-charref
http://normal-website.com	https://jquery.com/
https://jquery.org/license	https://github.com/whatwg/html/issues/2369
https://html.spec.whatwg.org/#nonce-attributes	https://drafts.csswg.org/cssom/#common-serializing-idioms
https://www.w3.org/TR/css-syntax-3/#ident-token-diagram	https://www.w3.org/TR/selectors/#attribute-selectors
https://www.w3.org/TR/CSS21/syndata.html#escaped-characters	https://bugs.jquery.com/ticket/13393
https://github.com/jquery/sizzle/issues/157	https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled	https://html.spec.whatwg.org/multipage/forms.html#category-listed
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
https://bugs.webkit.org/show_bug.cgi?id=136851	https://drafts.csswg.org/selectors/#relational
https://github.com/jquery/sizzle/pull/225	https://www.w3.org/TR/selectors/#pseudo-classes
https://github.com/jquery/sizzle/issues/299	https://www.w3.org/TR/selectors/#lang-pseudo
https://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked	https://www.w3.org/TR/selectors/#empty-pseudo
https://promisesaplus.com/#point-59	https://promisesaplus.com/#point-48
https://promisesaplus.com/#point-54	https://promisesaplus.com/#point-75
https://promisesaplus.com/#point-64	https://promisesaplus.com/#point-61
https://promisesaplus.com/#point-57	https://bugs.chromium.org/p/chromium/issues/detail?id=378607
https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click	https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order
https://bugs.chromium.org/p/chromium/issues/detail?id=449857	https://bugs.chromium.org/p/chromium/issues/detail?id=470258
https://connect.microsoft.com/IE/feedback/details/1736512/	https://jsperf.com/getall-vs-sizzle/2
https://www.w3.org/TR/css-syntax-3/#input-preprocessing	https://drafts.csswg.org/cssom/#resolved-values
https://developer.mozilla.org/en-US/docs/CSS/display	https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace	https://html.spec.whatwg.org/#strip-and-collapse-whitespace
http://example.com:80x/	https://bugs.webkit.org/show_bug.cgi?id=137337
https://bugs.webkit.org/show_bug.cgi?id=29084	https://bugs.chromium.org/p/chromium/issues/detail?id=589347
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	https://github.com/jquery/jquery/pull/557
https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js	https://github.com/WebAudio/web-audio-api/issues/790
https://github.com/Microsoft/TypeScript/issues/11498	https://webaudio.github.io/web-audio-api/#audioworklet
https://github.com/microsoft/cognitive-services-speech-sdk-js/issues/465	https://github.com/TooTallNate/node-agent-base/issues/61
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DataView	https://developer.mozilla.org/en-US/docs/Web/API/AudioContext
https://www.w3.org/TR/media-source/	https://developer.mozilla.org/en-US/docs/Web/API/RTCPeerConnection/icegatheringstatechange_event
https://aka.ms/csspeech/region	https://aka.ms/csspeech/voicenames

Page 1 of 3

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs9odeC5/YH/CgL/t3ca8onB9O5IVv1Z+1+uy5o5c3QXZC38v0SJaJBWvDaA+H7ZPOZHVRZGQ2B8l1EcjKvFvVxBANxYszIYZlENGFESnIPEazWOYKRKW2Fjtnl+kRQDxWp9rvgbx54m6qPh8ALuuZJ44ETdI5qFRd+tU3pCvkIqsAt1/ccL0q3K2EEj0yTjHwl/O01Z0UFsVQwZ8Q/DbfzFDR0E8txNxbUqojwn4yzNZ6odrrLCcFEqxbMRqg5Ern3IFKPraXH+byuDSzyKPk6VW4bVpoLSnfP+LRwsX0eNSStmnvRPe2sYsDw9x4R+2vkgln7Sk3Cdy7y+9A8UdpwIDAQAB",
  "name": "__MSG_appName__",
  "icons": {
    "48": "images/48.png"
  },
  "action": {
    "default_icon": {
      "48": "images/48.png"
    },
    "default_popup": "popup/login.html"
  },
  "author": "Lewis Zhang",
  "oauth2": {
    "scopes": [
      ""
    ],
    "client_id": "820268438758-qfd3cmpa0uu5q6j10qf83p15tsr0v4dh.apps.googleusercontent.com"
  },
  "version": "3.3.1",
  "background": {
    "type": "module",
    "service_worker": "background.bundle.js"
  },
  "short_name": "TubeX",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_appDesc__",
  "permissions": [
    "storage",
    "webRequest"
  ],
  "homepage_url": "https://tubex.chat",
  "default_locale": "zh_CN",
  "content_scripts": [
    {
      "js": [
        "contentscript/index.bundle.js"
      ],
      "css": [
        "contentscript/yt_ai_summary.css"
      ],
      "matches": [
        "https://www.youtube.com/*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "https://www.youtube.com/*",
    "https://translate.googleapis.com/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  }
}

by ✦ Astarte

TubeX.Chat: YouTube AI智能体

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (191 total):

Raw Manifest

Detections

Manifest Findings