Tentatively

Version 0.3 View in Chrome Web Store

Last scanned: 9 days ago | force re-scan

Extension Details

Developer: tentatively.xyz

Rating: 3.1 ★ (7 ratings)

Users: 741

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a very small user base of only 741 users and a below-average rating of 3.1 stars from just 7 reviews, indicating limited adoption and mixed user satisfaction. The developer domain "tentatively.xyz" appears to be a personal or small project rather than an established company, which reduces institutional trust. The lack of detailed developer information and missing last updated date make it difficult to assess ongoing maintenance and support.

Concerns: The primary concern is the identity permission combined with content script access to Google Calendar. This combination allows the extension to potentially access your Google account identity information while operating within your calendar interface. The identity permission is particularly sensitive as it can access authentication tokens and user profile data. The low user adoption and poor rating suggest potential functionality or reliability issues that users have encountered.

Recommendations: Given the medium risk level, consider running this extension in a separate Chrome profile to isolate it from your main browsing session and other extensions. Before installing, carefully evaluate whether the extension's functionality justifies the identity permission access. Monitor the extension's behavior closely after installation and remove it immediately if you notice any suspicious activity or unauthorized access attempts. Consider looking for alternative calendar extensions with better ratings and larger user bases that might provide similar functionality with more transparent privacy practices.

Findings

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjLD5iXDDRltT1iRuXaiijDTef4Wss4B8lP29xeXOzZrd7XujP6oCp/N2PsdUH0LqbLmHwxogqRvczcBaBB6jgzNkBBTYTsgSVuL31W/gR4jTnpE/PkidkoX8jfq78UZed5OvwGD3+wmKbI5vqeHUzpQQuT7VixMqV1BAoSoxpDFlAMvwiP3Uyocp5+g0FQyye8HbgDwEtCmQFKk4CNo4SPbvCorMOS/gFkwshG5UgOBQVgyANbIP9lCv+zUVMyzOqqz3C7vjMtjwTiihhkxUoj1f/OdVWkUeJCSDcBYHyW8JMPbBlVrpLU9pUt9xxOI1A56jL0MH5UYQlNTxSrlDpQIDAQAB",
  "name": "Tentatively",
  "icons": {
    "16": "icon16.png",
    "48": "icon48.png",
    "128": "icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16_gray.png",
      "48": "icon48_gray.png",
      "128": "icon128_gray.png"
    },
    "default_title": "Tentatively\nDisabled for this site"
  },
  "author": "Jason Geffner",
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/calendar.readonly",
      "https://www.googleapis.com/auth/calendar.events"
    ],
    "client_id": "1023394886692-4bm5tohrq1tbi3iis42v1fbvo6mrclgn.apps.googleusercontent.com"
  },
  "version": "0.3",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Sets Google Calendar events to tentative.",
  "permissions": [
    "identity"
  ],
  "content_scripts": [
    {
      "js": [
        "tentative.js"
      ],
      "css": [
        "style.css"
      ],
      "matches": [
        "https://calendar.google.com/calendar/*"
      ]
    }
  ],
  "manifest_version": 3
}

by ✦ Astarte

Tentatively

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (6 total):

Raw Manifest

Detections

Manifest Findings

https://www.googleapis.com/calendar/v3/calendars/	https://www.googleapis.com/calendar/v3/users/me/calendarList?minAccessRole=writer
https://clients2.google.com/service/update2/crx	https://calendar.google.com/calendar/
https://www.googleapis.com/auth/calendar.readonly	https://www.googleapis.com/auth/calendar.events