[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

SiftHub: AI Sales Platform

Version 2.1.7.9 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: SpeedUp Inc

Rating: 5.0 ★ (2 ratings)

Users: 570

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 10 total findings, including 8 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardRead

This extension has the clipboardRead permission. Can read clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe WebAssembly Execution

This extension's Content Security Policy allows 'wasm-unsafe-eval', which permits potentially dangerous WebAssembly code execution. This could be used to hide malicious code or perform CPU-intensive operations.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

sidePanel
tabs
storage
scripting
webNavigation
contextMenus
cookies
clipboardRead
clipboardWrite

Host Permissions:

*://*/*
<all_urls>

Content Security Policy:

extension_pages: script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; connect-src 'self' chrome-extension: https: wss: data: blob: https://*.googleapis.com https://*.google.com https://*.gstatic.com https://*.firebase.com https://*.firebaseapp.com https://www.google-analytics.com https://analytics.google.com https://dev.sifthub.io https://staging.sifthub.io https://app.sifthub.io https://firestore.googleapis.com https://firebase.googleapis.com https://identitytoolkit.googleapis.com wss://firestore.googleapis.com https://*.run.app https://us.i.posthog.com https://us-assets.i.posthog.com https://app.posthog.com https://t.posthog.com https://*.trackjs.com; img-src 'self' data: https: blob:; font-src 'self' data: https:; style-src 'self' 'unsafe-inline' https:;

Embedded URLs (80 total):

http://jedwatson.github.io/classnames	https://github.com/facebook/regenerator/blob/main/LICENSE
https://trackjs.com/terms/	http://www.apache.org/licenses/LICENSE-2.0
https://app.sifthub.io//	https://bit.ly/3cXEKWf
https://quilljs.com	https://quilljs.com/
http://www.w3.org/1998/Math/MathML	http://www.w3.org/2000/svg
http://www.w3.org/1999/xhtml	https://momentjs.com/timezone/docs/#/use-it/browser/
http://momentjs.com/timezone/docs/#/data-loading/.	http://momentjs.com/guides/#/warnings/define-locale/
http://momentjs.com/guides/#/warnings/js-date/	http://momentjs.com/guides/#/warnings/min-max/
http://momentjs.com/guides/#/warnings/add-inverted-param/	http://momentjs.com/guides/#/warnings/zone/
http://momentjs.com/guides/#/warnings/dst-shifted/	https://github.com/zenoamaro/react-quill#using-deltas
https://icons.duckduckgo.com/ip3/	https://github.com/markedjs/marked.
https://github.com/date-fns/date-fns/blob/master/docs/upgradeGuide.md#string-arguments	https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md
https://capture.trackjs.com/capture	http://capture.trackjs.com/capture
https://usage.trackjs.com/fault.gif	https://usage.trackjs.com/usage.gif
https://app.sifthub.io/api/v1	https://app.sifthub.io/preview
https://app.sifthub.io/	https://app.sifthub.io
https://static.sifthub.io	http://fb.me/use-check-prop-types
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	https://redux.js.org/Errors?code=
https://apis.google.com/js/api.js	https://www.google.com/recaptcha/api.js
https://www.google.com/recaptcha/enterprise.js?render=	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://securetoken.google.com/	https://app.posthog.com/home#panel=support%3Asupport%3A.
https://posthog.com/surveys	https://sentry.io/organizations/
https://posthog.com/docs/billing/limits-alerts	http://yandex.com/bots
https://app.posthog.com	https://us.i.posthog.com
https://us.posthog.com	https://www.google-analytics.com/debug/mp/collect
https://www.google-analytics.com/mp/collect	https://sifthub.zendesk.com/access/jwt?jwt=
https://help.sifthub.io/hc/en-us	https://www.sifthub.io/book-a-demo
https://chromewebstore.google.com/detail/sifthub-ai-sales-engineer/igipoifkpmbafcniopcceeebkeohgmod	https://static.sifthub.io/assets/DocumentShareBrowserExtension.png
https://docs.google.com/presentation/d/	https://mail.google.com/mail/u/0/
https://static.sifthub.io/assets/	https://app.sifthub.io/autofill?nudge=1
https://static.sifthub.io/	https://docs.google.com/spreadsheets/u/0/?tgif=d
https://docs.google.com/document/u/0/?tgif=d	https://static.sifthub.io/assets/AutofillCompletedSheets.gif
https://static.sifthub.io/assets/CellShortcutsContextMenuInfo.png?v=0.0.1	https://static.sifthub.io/assets/MailComposeWidgetContextMenuInfo.png?v=0.0.1
https://static.sifthub.io/assets/FloatingWidgetContextMenuInfo.png?v=0.0.3	https://clients2.google.com/service/update2/crx
https://chromewebstore.google.com/	https://www.google-analytics.com
https://analytics.google.com	https://dev.sifthub.io
https://staging.sifthub.io	https://firestore.googleapis.com
https://firebase.googleapis.com	https://identitytoolkit.googleapis.com
https://us-assets.i.posthog.com	https://t.posthog.com

Raw Manifest

{
  "name": "SiftHub: AI Sales Platform",
  "icons": {
    "16": "icon16.png",
    "32": "icon32.png",
    "48": "icon48.png",
    "128": "icon128.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16.png",
      "32": "icon32.png",
      "48": "icon48.png",
      "128": "icon128.png"
    }
  },
  "version": "2.1.7.9",
  "background": {
    "type": "module",
    "service_worker": "serviceWorker.js"
  },
  "side_panel": {
    "default_path": "index.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "SiftHub is an AI-native platform for sales engineers, AEs, and presales teams to complete RFPs, proposals, and briefs faster.",
  "permissions": [
    "sidePanel",
    "tabs",
    "storage",
    "scripting",
    "webNavigation",
    "contextMenus",
    "cookies",
    "clipboardRead",
    "clipboardWrite"
  ],
  "content_scripts": [
    {
      "js": [
        "gdocAnnotatedCanvasContentScript.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://docs.google.com/*"
      ],
      "all_frames": false
    },
    {
      "js": [
        "widget.js"
      ],
      "matches": [
        "<all_urls>"
      ],
      "exclude_matches": [
        "https://chromewebstore.google.com/"
      ]
    }
  ],
  "host_permissions": [
    "*://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://app.sifthub.io/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; connect-src 'self' chrome-extension: https: wss: data: blob: https://*.googleapis.com https://*.google.com https://*.gstatic.com https://*.firebase.com https://*.firebaseapp.com https://www.google-analytics.com https://analytics.google.com https://dev.sifthub.io https://staging.sifthub.io https://app.sifthub.io https://firestore.googleapis.com https://firebase.googleapis.com https://identitytoolkit.googleapis.com wss://firestore.googleapis.com https://*.run.app https://us.i.posthog.com https://us-assets.i.posthog.com https://app.posthog.com https://t.posthog.com https://*.trackjs.com; img-src 'self' data: https: blob:; font-src 'self' data: https:; style-src 'self' 'unsafe-inline' https:;"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://docs.google.com/*"
      ],
      "resources": [
        "gdocAnnotatedCanvas.js",
        "gdocAnnotatedCanvasContentScript.js"
      ]
    }
  ]
}

by ✦ Astarte

SiftHub: AI Sales Platform

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (80 total):

Raw Manifest

Detections

Manifest Findings