[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

AgroMod: The Only Agar.io Merge Timer

Version 1.3.2 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Developer: http://sandhoefner.github.io/

Rating: 3.1 ★ (126 ratings)

Users: 1,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has a modest user base of 1,000 users with a below-average rating of 3.1 stars from 126 reviews, suggesting mixed user experiences. The developer provides a GitHub Pages URL which offers some transparency, though limited company information is available. The extension serves a very specific gaming purpose for Agar.io players, which aligns with its narrow scope of permissions.

Concerns:

- The below-average rating of 3.1 stars indicates potential functionality or user experience issues that warrant caution

- Uses the older Manifest V2 framework, which has weaker security protections compared to the current V3 standard

- Storage permission allows data persistence, though this appears necessary for timer functionality

- Limited developer information beyond a GitHub Pages link reduces accountability

- Small user base means less community vetting of the extension's behavior

Recommendations:

Given the medium risk level, you can safely use this extension in your main browser profile while remaining vigilant. Monitor the extension's behavior and consider checking user reviews for recent feedback about functionality or security concerns. Since this is a gaming utility with limited permissions scope, the risk is manageable. However, if you're particularly security-conscious, you could run it in a separate Chrome profile dedicated to gaming activities. Keep an eye out for updates that might migrate to Manifest V3 for improved security.

Findings

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Raw Manifest

{
  "name": "AgroMod: The Only Agar.io Merge Timer",
  "icons": {
    "16": "doge-16-.png",
    "48": "doge-48-.png",
    "128": "doge-128-.png"
  },
  "author": "Evan Sandhoefner",
  "version": "1.3.2",
  "background": {
    "scripts": [
      "background.js"
    ],
    "persistent": false
  },
  "short_name": "AgroMod",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Take your Agar game to the next level with a tactical merge timer, 7-w hotkey for virus attacks, and persistent settings.",
  "page_action": {
    "default_icon": {
      "19": "doge-19.png",
      "38": "doge-38.png"
    },
    "default_popup": "popup.html",
    "default_title": "AgroMod"
  },
  "permissions": [
    "storage",
    "declarativeContent"
  ],
  "options_page": "options.html",
  "content_scripts": [
    {
      "js": [
        "d3.js",
        "page.js",
        "jquery.js"
      ],
      "matches": [
        "http://agar.io/*"
      ]
    }
  ],
  "manifest_version": 2,
  "web_accessible_resources": [
    "options.html"
  ]
}

by ✦ Astarte

http://www.w3.org/2000/svg	http://www.w3.org/1999/xhtml
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/	https://clients2.google.com/service/update2/crx
http://agar.io/	https://chrome.google.com/webstore/detail/agario-mod/kekfokjeliilaipagomdhmlfhbmpllkk/support
http://unixpapa.com/js/key.html	http://stackoverflow.com/questions/11816431/how-to-add-a-html5-canvas-within-a-div
http://stackoverflow.com/questions/1495219/how-can-i-prevent-the-backspace-key-from-navigating-back	http://pastie.org/10199526
http://agario.wikia.com/wiki/Virus#Mechanics

AgroMod: The Only Agar.io Merge Timer

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (13 total):

Raw Manifest

Detections

Manifest Findings