[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Slate for Rise

Version 2.1.1 View in Chrome Web Store

Last scanned: 1 day ago | force re-scan

Extension Details

Rating: 0.0 ★

Users: 82

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has extremely low adoption with only 82 users and no ratings, which provides no community validation. The lack of author information and developer details raises significant transparency concerns. The extension appears to be designed for Articulate Rise, a legitimate e-learning platform, but the minimal user base suggests it may be unofficial or experimental.

Concerns:

The extension requests excessive permissions that seem disproportionate for a simple Rise integration tool. The downloads permission combined with broad host access creates potential for data exfiltration. The webNavigation permission allows comprehensive browsing tracking beyond the stated purpose. The unsafe WebAssembly execution policy ('wasm-unsafe-eval') is particularly concerning as it can hide malicious code execution. The broad host permissions spanning multiple domains including AWS S3, GitHub, and HuggingFace repositories suggest functionality far beyond basic Rise integration.

Recommendations:

Given the critical risk level, avoid installing this extension on your primary browser profile. If you must use it, create a dedicated Chrome profile with no sensitive data or accounts. Consider using official Articulate tools instead. If installation is necessary, monitor network activity and file downloads closely. The combination of low user adoption, missing developer information, and excessive permissions suggests this extension may be malicious or poorly designed. Wait for official alternatives or extensions with better security practices and community validation.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: *://articulate-us.s3.amazonaws.com/*, *://fonts.googleapis.com/*, https://raw.githubusercontent.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

downloads
storage
unlimitedStorage
alarms
scripting
tabs
activeTab
webNavigation

Host Permissions:

*://articulate-us.s3.amazonaws.com/*
https://rise.articulate.com/*
https://articulateusercontent.com/*
*://fonts.googleapis.com/*
*://fonts.gstatic.com/*
*://*.articulate.com/*
https://cdn.jsdelivr.net/*
https://huggingface.co/*
https://*.huggingface.co/*
https://raw.githubusercontent.com/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'

Embedded URLs (5300 total):

https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css	https://slatebuilder.io/notes/understanding-block-ids
https://slatebuilder.io/notes/live-css-preview-v1-5-0	https://overridelabs.ca/blog/05.html
https://overridelabs.ca/community-resources	https://slatebuilder.io
https://rise.articulate.com/author/	https://rise.articulate.com/authoring/
http://www.w3.org/2000/svg	http://stuartk.com/jszip
https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.	https://github.com/nodeca/pako/blob/main/LICENSE
https://stuk.github.io/jszip/documentation/howto/read_zip.html	https://slatebuilder.io/privacy/slate-for-rise
https://forms.gle/eQKxD7jySctV59ZA6	https://overridelabs.ca/blog.html
https://www.llama.com/llama3_2/license/	https://github.com/mlc-ai/web-llm
https://github.com/microsoft/monaco-editor	https://github.com/Stuk/jszip
https://webgpureport.org/	https://raw.githubusercontent.com/mlc-ai/binary-mlc-llm-libs/main/web-llm-models/
https://huggingface.co/mlc-ai/Llama-3.2-1B-Instruct-q4f32_1-MLC	https://huggingface.co/mlc-ai/Llama-3.2-1B-Instruct-q4f16_1-MLC
https://huggingface.co/mlc-ai/Llama-3.2-1B-Instruct-q0f16-MLC	https://huggingface.co/mlc-ai/Llama-3.2-3B-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Llama-3.2-3B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Llama-3.1-8B-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Llama-3.1-8B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Qwen-7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Qwen-7B-q4f32_1-MLC	https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Llama-8B-q4f32_1-MLC
https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Llama-8B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Hermes-2-Theta-Llama-3-8B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Hermes-2-Theta-Llama-3-8B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Hermes-2-Pro-Llama-3-8B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Hermes-2-Pro-Llama-3-8B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Hermes-3-Llama-3.2-3B-q4f32_1-MLC
https://huggingface.co/mlc-ai/Hermes-3-Llama-3.2-3B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Hermes-3-Llama-3.1-8B-q4f32_1-MLC
https://huggingface.co/mlc-ai/Hermes-3-Llama-3.1-8B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Hermes-2-Pro-Mistral-7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Phi-3.5-mini-instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Phi-3.5-mini-instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Phi-3.5-vision-instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Phi-3.5-vision-instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Mistral-7B-Instruct-v0.3-q4f16_1-MLC	https://huggingface.co/mlc-ai/Mistral-7B-Instruct-v0.3-q4f32_1-MLC
https://huggingface.co/mlc-ai/Mistral-7B-Instruct-v0.2-q4f16_1-MLC	https://huggingface.co/mlc-ai/OpenHermes-2.5-Mistral-7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/NeuralHermes-2.5-Mistral-7B-q4f16_1-MLC	https://huggingface.co/mlc-ai/WizardMath-7B-V1.1-q4f16_1-MLC
https://huggingface.co/mlc-ai/SmolLM2-1.7B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/SmolLM2-1.7B-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q0f16-MLC	https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q0f32-MLC
https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/SmolLM2-135M-Instruct-q0f16-MLC	https://huggingface.co/mlc-ai/SmolLM2-135M-Instruct-q0f32-MLC
https://huggingface.co/mlc-ai/gemma-2-2b-it-q4f16_1-MLC	https://huggingface.co/mlc-ai/gemma-2-2b-it-q4f32_1-MLC
https://huggingface.co/mlc-ai/gemma-2-9b-it-q4f16_1-MLC	https://huggingface.co/mlc-ai/gemma-2-9b-it-q4f32_1-MLC
https://huggingface.co/mlc-ai/gemma-2-2b-jpn-it-q4f16_1-MLC	https://huggingface.co/mlc-ai/gemma-2-2b-jpn-it-q4f32_1-MLC
https://huggingface.co/mlc-ai/Qwen3-0.6B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Qwen3-0.6B-q4f32_1-MLC
https://huggingface.co/mlc-ai/Qwen3-0.6B-q0f16-MLC	https://huggingface.co/mlc-ai/Qwen3-1.7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen3-1.7B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen3-4B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen3-4B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen3-8B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen3-8B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen2.5-0.5B-Instruct-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen2.5-0.5B-Instruct-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen2.5-0.5B-Instruct-q0f16-MLC
https://huggingface.co/mlc-ai/Qwen2.5-1.5B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Qwen2.5-1.5B-Instruct-q4f32_1-MLC

Page 1 of 67

Raw Manifest

{
  "name": "Slate for Rise",
  "icons": {
    "16": "icons/icon16.png",
    "32": "icons/icon32.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon16.png",
      "32": "icons/icon32.png",
      "48": "icons/icon48.png"
    },
    "default_popup": "popup.html"
  },
  "version": "2.1.1",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Patch and customize Rise SCORM exports with custom CSS, JS, and more. Built by Slate eLearning.",
  "permissions": [
    "downloads",
    "storage",
    "unlimitedStorage",
    "alarms",
    "scripting",
    "tabs",
    "activeTab",
    "webNavigation"
  ],
  "content_scripts": [
    {
      "js": [
        "toast-messages.js",
        "content-preview.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://rise.articulate.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "toast-messages.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://articulateusercontent.com/review/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "toast-messages.js",
        "content-edit.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://rise.articulate.com/author/*",
        "https://rise.articulate.com/authoring/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "*://articulate-us.s3.amazonaws.com/*",
    "https://rise.articulate.com/*",
    "https://articulateusercontent.com/*",
    "*://fonts.googleapis.com/*",
    "*://fonts.gstatic.com/*",
    "*://*.articulate.com/*",
    "https://cdn.jsdelivr.net/*",
    "https://huggingface.co/*",
    "https://*.huggingface.co/*",
    "https://raw.githubusercontent.com/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://rise.articulate.com/*"
      ],
      "resources": [
        "jszip.min.js",
        "custom/patch.txt",
        "editor.html",
        "editor.js",
        "manual.html",
        "monaco/**",
        "ai/ai-service.js",
        "ai/ai-download.html",
        "ai/ai-download.js",
        "ai/ai-info.html",
        "ai/ai-info.js",
        "ai/monaco-integration.js",
        "ai/llm-engine.js",
        "ai/llm-prompts.js",
        "ai/llm-test.html",
        "ai/llm-test.js",
        "ai/llm-sandbox.html",
        "ai/llm-sandbox.js",
        "ai/llm-bridge.js",
        "ai/web-llm.bundle.js",
        "svg-modifier.html",
        "svg-modifier.js",
        "image-compressor.html",
        "image-compressor.js",
        "browser-image-compression.min.js",
        "subtitle-tool.html",
        "subtitle-tool.js",
        "colour-palettes.html",
        "colour-palettes.js",
        "copy-block-id.js",
        "content-preview.js",
        "content-edit.js",
        "content-loader.js"
      ]
    }
  ]
}

by ✦ Astarte

Slate for Rise

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (5300 total):

Raw Manifest

Detections

Manifest Findings