[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Powersave

Version 3.16.1 View in Chrome Web Store

Last scanned: about 2 hours ago

Extension Details

Developer: powersave.pro

Rating: 4.8 ★ (8 ratings)

Users: 603

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has very limited user adoption with only 603 users, which raises concerns about its legitimacy and testing. While it maintains a high rating of 4.8 stars, this is based on only 8 reviews, making the rating statistically insignificant. The developer "powersave.pro" lacks established reputation or verifiable company information, and the missing description provides no clarity about the extension's actual functionality or purpose.

Concerns:

The extension requests extremely broad permissions that are disproportionate to what a typical "powersave" utility would require. The identity permission is particularly concerning as it can access personal Google account information. The combination of universal host permissions (*://*/*) and content script injection capabilities creates a powerful surveillance tool that could monitor all browsing activity, steal credentials, and access sensitive data across any website. The activeTab, scripting, and contextMenus permissions further expand its ability to interact with and modify web content.

Recommendations:

Given the high risk profile, avoid installing this extension entirely. If you must use it, run it in a completely isolated Chrome profile with no access to personal accounts or sensitive websites. Consider seeking alternative power management solutions from established developers with transparent functionality descriptions and larger user bases. The broad permissions combined with unclear purpose and minimal user adoption suggest this could be a potentially malicious extension disguised as a utility tool.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

identity
storage
activeTab
scripting
sidePanel
contextMenus
alarms

Host Permissions:

*://*/*
<all_urls>

Embedded URLs (147 total):

http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd	http://www.w3.org/2000/svg
https://clients2.google.com/service/update2/crx	https://api.airtable.com/v0
https://powersave.pro/docs/features/update.html	https://vuejs.org/error-reference/#runtime-
https://powersave.pro/docs/destinations/webhooks.html#Headers	https://powersave.pro/docs/destinations/webhooks.html#URL
https://powersave.pro/docs/destinations/webhooks.html#Method	https://powersave.pro
https://slack.com/api/conversations.list	https://slack.com/app_redirect?channel=
https://slack.com/archives/	https://slack.com/
https://slack.com/api/chat.postMessage	https://slack.com/api/chat.getPermalink
https://app.clickup.com/	https://app.clickup.com/t/
https://api.clickup.com/api/v2	https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md
http://adamwdraper.github.com/Numeral-js/	https://airtable.com/
https://calendar.google.com/calendar/render	https://outlook.live.com/calendar/deeplink/compose
https://coda.io/developers/apis/v1#operation/createTable	https://coda.io/d/_d
https://coda.io/d/_	https://coda.io/apis/v1
https://mail.google.com/mail/	https://outlook.live.com/owa/
https://mail.zoho.com/mail/	https://api.notion.com/v1
https://www.notion.so/YourWorkspace/	https://notion.so/
http://getify.mit-license.org	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xlink	https://forms.fillout.com/t/kStb7EZZZ8us
https://powersave.pro/status	https://powersave.pro/docs/support/pro.html
https://formkit.com/essentials/validation#accepted	https://formkit.com/essentials/validation#date-after
https://formkit.com/essentials/validation#alpha	https://formkit.com/essentials/validation#alphanumeric
https://formkit.com/essentials/validation#alpha-spaces	https://formkit.com/essentials/validation#contains_alpha
https://formkit.com/essentials/validation#contains_alphanumeric	https://formkit.com/essentials/validation#contains_alpha-spaces
https://formkit.com/essentials/validation#contains_symbol	https://formkit.com/essentials/validation#contains_uppercase
https://formkit.com/essentials/validation#contains_lowercase	https://formkit.com/essentials/validation#contains_numeric
https://formkit.com/essentials/validation#symbol	https://formkit.com/essentials/validation#uppercase
https://formkit.com/essentials/validation#lowercase	https://formkit.com/essentials/validation#date-before
https://formkit.com/essentials/validation#between	https://formkit.com/essentials/validation#confirm
https://formkit.com/essentials/validation#date-format	https://formkit.com/essentials/validation#date-between
https://formkit.com/essentials/validation#email	https://formkit.com/essentials/validation#ends-with
https://formkit.com/essentials/validation#is	https://formkit.com/essentials/validation#length
https://formkit.com/essentials/validation#matches	https://formkit.com/essentials/validation#max
https://formkit.com/essentials/validation#mime	https://formkit.com/essentials/validation#min
https://formkit.com/essentials/validation#not	https://formkit.com/essentials/validation#number
https://formkit.com/essentials/validation#require-one	https://formkit.com/essentials/validation#required
https://formkit.com/essentials/validation#starts-with	https://formkit.com/essentials/validation#url
https://cdn.jsdelivr.net/npm/@formkit/themes@	https://cdn.jsdelivr.net/npm/@formkit/icons@
https://formkit.com/advanced/core#message-store	https://formkit.com/inputs/
https://prosemirror.net/docs/ref/#model.Node.textBetween	https://prosemirror.net/docs/ref/#model.MarkSpec.excludes

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiDHAJG41JF9ada/k0Su2W+hdIuCiDPvGAAe/TZwkabDBloKwZPqYV8tNDkMo1RbW7R6lEAXwPpyRrHEig7rrTHwjG1FJ0BLRFvP5AmmasDEVwDthcszGULa2S7d3Ezgi/2HgEdlrU20lT/A5dVmcItvLg3TgKuBxT0uib6wH0eDJa9QZW7MShw2/YXMebynHsKlks6oFGAw7zrSRqlAyE5PukmzQHw204hjtuw3Fsj60L5fU35PK8mCEufX/t1gwtmuQZxq+ZUc0z1qRtfRbEvDRAE00wZtHvMthNtVJP9faGL+U0jFjEXHmSS+kfJxIJNEF3uV3i1mrL6hF2V++IQIDAQAB",
  "name": "Powersave",
  "icons": {
    "16": "icons/16-white-4.png",
    "32": "icons/32-simple-6.png",
    "192": "icons/192.png",
    "384": "icons/384.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/16-white-4.png",
      "32": "icons/32-simple-6.png"
    }
  },
  "author": "github.com/MartinMalinda",
  "omnibox": {
    "keyword": "ps"
  },
  "version": "3.16.1",
  "commands": {
    "Command_1": {
      "global": false,
      "description": "Run Command 1",
      "suggested_key": {
        "default": "Alt+Shift+1"
      }
    },
    "Command_2": {
      "global": false,
      "description": "Run Command 2",
      "suggested_key": {
        "default": "Alt+Shift+2"
      }
    },
    "Command_3": {
      "global": false,
      "description": "Run Command 3",
      "suggested_key": {
        "default": "Alt+Shift+3"
      }
    },
    "_execute_action": {
      "global": false,
      "description": "Open Side Panel",
      "suggested_key": {
        "mac": "Command+Shift+P",
        "default": "Ctrl+Shift+P"
      }
    }
  },
  "background": {
    "type": "module",
    "service_worker": "serviceWorker.js"
  },
  "side_panel": {
    "default_path": "src/entries/popup/index.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Save ASAP with AI. Save more, categorize & analyze as you browse to Airtable, Coda, Notion and elsewhere.",
  "permissions": [
    "identity",
    "storage",
    "activeTab",
    "scripting",
    "sidePanel",
    "contextMenus",
    "alarms"
  ],
  "content_scripts": [
    {
      "js": [
        "src/entries/selection/selection.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*/*"
      ]
    },
    {
      "js": [
        "src/entries/message/message.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*/*"
      ]
    }
  ],
  "host_permissions": [
    "*://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "src/entries/payment/index.html",
        "src/entries/popup/index.html",
        "src/entries/success/index.html",
        "success.html"
      ]
    },
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "assets/CloseButton-PPiI9tWH.css",
        "assets/CloseButton-qnW74yUR.js",
        "assets/CropPicker-C05iUexY.js",
        "assets/ElementPicker-BN6zbdBf.js",
        "assets/ElementPicker-C18l_z-E.css",
        "assets/Erase-Ba_mnWIY.js",
        "assets/Logo5-B0yX3zOc.js",
        "assets/Stars-DUnPzSwU.js",
        "assets/_commonjsHelpers-fE0yFewp.js",
        "assets/auth-utils-BcIb0A2A.js",
        "assets/destination-CZYf6fPk.css",
        "assets/destination-zKrDwD9x.js",
        "assets/el-TO-SXlqx.js",
        "assets/event-CkrdJcD6.js",
        "assets/index-BwPZEPXv.js",
        "assets/link-match-CvPz1uiT.js",
        "assets/message-BPOAgIfv.js",
        "assets/runtime-core.esm-bundler-Dcqgka72.js",
        "assets/src/entries/message/message-vCgydKaf.js",
        "assets/src/entries/selection/selection-BjEeO_g7.js",
        "assets/storage-CD0dvUxy.js",
        "assets/utils-D5USCUD0.js",
        "assets/vue.runtime.esm-bundler-DahRpb7-.js"
      ]
    }
  ]
}

by ✦ Astarte

Powersave

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (147 total):

Raw Manifest

Detections

Manifest Findings