[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Slate for Rise

Version 2.1.1 View in Chrome Web Store

Last scanned: about 1 hour ago

Extension Details

Rating: 4.7 ★

Users: 120

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has a very small user base of only 120 users, which raises concerns about its legitimacy and testing. While it maintains a 4.7-star rating, the limited adoption suggests minimal community vetting. The lack of visible developer information and company details makes it difficult to assess the publisher's reputation and accountability.

Concerns:

The extension requests excessive permissions that seem disproportionate for a tool designed to work with Rise (Articulate's e-learning platform). The downloads permission combined with broad host access creates potential for data exfiltration. The webNavigation permission allows comprehensive tracking of browsing behavior beyond the intended Rise platform. The unsafe WebAssembly execution policy is particularly concerning as it could hide malicious code. The broad host permissions extend far beyond Rise-related domains, including access to GitHub, HuggingFace, and various CDNs, which appears unnecessary for the stated purpose.

Recommendations:

Given the critical risk level, avoid installing this extension on your primary browser profile. If you must use it, create a dedicated Chrome profile with limited sensitive data and bookmarks. Consider whether the functionality is truly necessary, as legitimate Rise integrations typically don't require such extensive permissions. Monitor your download folder and browser activity closely if you proceed with installation. Contact Articulate directly to verify if this is an official or recommended tool for their platform.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: *://articulate-us.s3.amazonaws.com/*, *://fonts.googleapis.com/*, https://raw.githubusercontent.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

downloads
storage
unlimitedStorage
alarms
scripting
tabs
activeTab
webNavigation

Host Permissions:

*://articulate-us.s3.amazonaws.com/*
https://rise.articulate.com/*
https://articulateusercontent.com/*
*://fonts.googleapis.com/*
*://fonts.gstatic.com/*
*://*.articulate.com/*
https://cdn.jsdelivr.net/*
https://huggingface.co/*
https://*.huggingface.co/*
https://raw.githubusercontent.com/*

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'

Embedded URLs (5300 total):

https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css	https://slatebuilder.io/notes/understanding-block-ids
https://slatebuilder.io/notes/live-css-preview-v1-5-0	https://overridelabs.ca/blog/05.html
https://overridelabs.ca/community-resources	https://slatebuilder.io
https://rise.articulate.com/author/	https://rise.articulate.com/authoring/
http://www.w3.org/2000/svg	http://stuartk.com/jszip
https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.	https://github.com/nodeca/pako/blob/main/LICENSE
https://stuk.github.io/jszip/documentation/howto/read_zip.html	https://slatebuilder.io/privacy/slate-for-rise
https://forms.gle/eQKxD7jySctV59ZA6	https://overridelabs.ca/blog.html
https://www.llama.com/llama3_2/license/	https://github.com/mlc-ai/web-llm
https://github.com/microsoft/monaco-editor	https://github.com/Stuk/jszip
https://webgpureport.org/	https://raw.githubusercontent.com/mlc-ai/binary-mlc-llm-libs/main/web-llm-models/
https://huggingface.co/mlc-ai/Llama-3.2-1B-Instruct-q4f32_1-MLC	https://huggingface.co/mlc-ai/Llama-3.2-1B-Instruct-q4f16_1-MLC
https://huggingface.co/mlc-ai/Llama-3.2-1B-Instruct-q0f16-MLC	https://huggingface.co/mlc-ai/Llama-3.2-3B-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Llama-3.2-3B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Llama-3.1-8B-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Llama-3.1-8B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Qwen-7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Qwen-7B-q4f32_1-MLC	https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Llama-8B-q4f32_1-MLC
https://huggingface.co/mlc-ai/DeepSeek-R1-Distill-Llama-8B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Hermes-2-Theta-Llama-3-8B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Hermes-2-Theta-Llama-3-8B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Hermes-2-Pro-Llama-3-8B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Hermes-2-Pro-Llama-3-8B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Hermes-3-Llama-3.2-3B-q4f32_1-MLC
https://huggingface.co/mlc-ai/Hermes-3-Llama-3.2-3B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Hermes-3-Llama-3.1-8B-q4f32_1-MLC
https://huggingface.co/mlc-ai/Hermes-3-Llama-3.1-8B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Hermes-2-Pro-Mistral-7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Phi-3.5-mini-instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Phi-3.5-mini-instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Phi-3.5-vision-instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Phi-3.5-vision-instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/Mistral-7B-Instruct-v0.3-q4f16_1-MLC	https://huggingface.co/mlc-ai/Mistral-7B-Instruct-v0.3-q4f32_1-MLC
https://huggingface.co/mlc-ai/Mistral-7B-Instruct-v0.2-q4f16_1-MLC	https://huggingface.co/mlc-ai/OpenHermes-2.5-Mistral-7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/NeuralHermes-2.5-Mistral-7B-q4f16_1-MLC	https://huggingface.co/mlc-ai/WizardMath-7B-V1.1-q4f16_1-MLC
https://huggingface.co/mlc-ai/SmolLM2-1.7B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/SmolLM2-1.7B-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q0f16-MLC	https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q0f32-MLC
https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/SmolLM2-360M-Instruct-q4f32_1-MLC
https://huggingface.co/mlc-ai/SmolLM2-135M-Instruct-q0f16-MLC	https://huggingface.co/mlc-ai/SmolLM2-135M-Instruct-q0f32-MLC
https://huggingface.co/mlc-ai/gemma-2-2b-it-q4f16_1-MLC	https://huggingface.co/mlc-ai/gemma-2-2b-it-q4f32_1-MLC
https://huggingface.co/mlc-ai/gemma-2-9b-it-q4f16_1-MLC	https://huggingface.co/mlc-ai/gemma-2-9b-it-q4f32_1-MLC
https://huggingface.co/mlc-ai/gemma-2-2b-jpn-it-q4f16_1-MLC	https://huggingface.co/mlc-ai/gemma-2-2b-jpn-it-q4f32_1-MLC
https://huggingface.co/mlc-ai/Qwen3-0.6B-q4f16_1-MLC	https://huggingface.co/mlc-ai/Qwen3-0.6B-q4f32_1-MLC
https://huggingface.co/mlc-ai/Qwen3-0.6B-q0f16-MLC	https://huggingface.co/mlc-ai/Qwen3-1.7B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen3-1.7B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen3-4B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen3-4B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen3-8B-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen3-8B-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen2.5-0.5B-Instruct-q4f16_1-MLC
https://huggingface.co/mlc-ai/Qwen2.5-0.5B-Instruct-q4f32_1-MLC	https://huggingface.co/mlc-ai/Qwen2.5-0.5B-Instruct-q0f16-MLC
https://huggingface.co/mlc-ai/Qwen2.5-1.5B-Instruct-q4f16_1-MLC	https://huggingface.co/mlc-ai/Qwen2.5-1.5B-Instruct-q4f32_1-MLC

Page 1 of 67

Raw Manifest

{
  "name": "Slate for Rise",
  "icons": {
    "16": "icons/icon16.png",
    "32": "icons/icon32.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon16.png",
      "32": "icons/icon32.png",
      "48": "icons/icon48.png"
    },
    "default_popup": "popup.html"
  },
  "version": "2.1.1",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Patch and customize Rise SCORM exports with custom CSS, JS, and more. Built by Slate eLearning.",
  "permissions": [
    "downloads",
    "storage",
    "unlimitedStorage",
    "alarms",
    "scripting",
    "tabs",
    "activeTab",
    "webNavigation"
  ],
  "content_scripts": [
    {
      "js": [
        "toast-messages.js",
        "content-preview.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://rise.articulate.com/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "toast-messages.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://articulateusercontent.com/review/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "toast-messages.js",
        "content-edit.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://rise.articulate.com/author/*",
        "https://rise.articulate.com/authoring/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "*://articulate-us.s3.amazonaws.com/*",
    "https://rise.articulate.com/*",
    "https://articulateusercontent.com/*",
    "*://fonts.googleapis.com/*",
    "*://fonts.gstatic.com/*",
    "*://*.articulate.com/*",
    "https://cdn.jsdelivr.net/*",
    "https://huggingface.co/*",
    "https://*.huggingface.co/*",
    "https://raw.githubusercontent.com/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://rise.articulate.com/*"
      ],
      "resources": [
        "jszip.min.js",
        "custom/patch.txt",
        "editor.html",
        "editor.js",
        "manual.html",
        "monaco/**",
        "ai/ai-service.js",
        "ai/ai-download.html",
        "ai/ai-download.js",
        "ai/ai-info.html",
        "ai/ai-info.js",
        "ai/monaco-integration.js",
        "ai/llm-engine.js",
        "ai/llm-prompts.js",
        "ai/llm-test.html",
        "ai/llm-test.js",
        "ai/llm-sandbox.html",
        "ai/llm-sandbox.js",
        "ai/llm-bridge.js",
        "ai/web-llm.bundle.js",
        "svg-modifier.html",
        "svg-modifier.js",
        "image-compressor.html",
        "image-compressor.js",
        "browser-image-compression.min.js",
        "subtitle-tool.html",
        "subtitle-tool.js",
        "colour-palettes.html",
        "colour-palettes.js",
        "copy-block-id.js",
        "content-preview.js",
        "content-edit.js",
        "content-loader.js"
      ]
    }
  ]
}

by ✦ Astarte

Slate for Rise

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (5300 total):

Raw Manifest

Detections

Manifest Findings