Random Student Generator for Google Classroom

Version 0.0.19 View in Chrome Web Store

Last scanned: 2 days ago | force re-scan

Extension Details

Rating: 3.2 ★ (10 ratings)

Users: 2,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has a concerning trust profile with only 2,000 users and a below-average rating of 3.2 stars from just 10 reviews. The lack of developer information and company details raises transparency concerns. The educational purpose appears legitimate for classroom management, but the limited adoption suggests either newer development or potential quality issues.

Concerns: The identity permission is particularly concerning for a classroom tool, as it can access Google account information beyond what's necessary for random student selection. The broad HTTP/HTTPS permissions (http://*/*, https://*/") allow access to all websites, which is excessive for a Google Classroom-specific tool. The combination of identity access with broad web permissions creates potential for data harvesting or account compromise. Using the older Manifest V2 also means fewer built-in security protections.

Recommendations: Given the high-risk identity permission and broad web access, consider running this extension in a separate Chrome profile dedicated to teaching activities. Before installation, verify the extension actually requires Google account access for its core functionality. Look for alternative random student generators that use more restrictive permissions. If you must use this extension, regularly review what data it has accessed through Chrome's privacy settings and consider the sensitivity of information in your Google Classroom environment.

Findings

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

identity
activeTab
storage
http://*/*
http://*/
https://*/

Content Security Policy:

script-src 'self' https://ssl.google-analytics.com; object-src 'self'

Embedded URLs (31 total):

https://fonts.googleapis.com/icon?family=Material+Icons	https://classroom.googleapis.com/v1/courses?courseStates=ACTIVE&teacherId=me
https://classroom.googleapis.com/v1/courses/	http://materializecss.com
https://raw.githubusercontent.com/Dogfalo/materialize/master/LICENSE	http://fian.my.id/Waves
https://github.com/fians/Waves/blob/master/LICENSE	http://polymer.github.io/LICENSE.txt
http://polymer.github.io/AUTHORS.txt	http://polymer.github.io/CONTRIBUTORS.txt
http://polymer.github.io/PATENTS.txt	https://github.com/Polymer/platform/issues/53.
http://amsul.github.io/pickadate.js	http://www.gsuitelikea.pro
http://gsuitelikea.pro/	https://github.com/js-cookie/js-cookie
http://www.w3.org/2000/svg	http://www.sitepoint.com/javascript-generate-lighter-darker-color
https://github.com/limonte/sweetalert2/wiki/Migration-from-SweetAlert-to-SweetAlert2#1-ie-support	https://limonte.github.io/sweetalert2/#ajax-request
http://stackoverflow.com/q/39626302/1331425	https://stackoverflow.com/a/3809435/1331425
http://stackoverflow.com/a/2345915/1331425	https://github.com/twbs/bootstrap/blob/master/js/modal.js#L279-L286
https://clients2.google.com/service/update2/crx	https://ssl.google-analytics.com
https://www.googleapis.com/auth/classroom.courses.readonly	https://www.googleapis.com/auth/classroom.rosters.readonly
https://www.googleapis.com/auth/classroom.profile.photos	https://ssl.google-analytics.com/ga.js
https://robohash.org/

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsL0vr3R7N3GpaNGCUEc45x0neLRrwT0FlTFx4lEx/XQVFOiwvqmtb810sySC7DTEQ5+1cXNOQ30AzUtiUtayVA8+vm1m4G4+eheXNfP0a1oF3gpPIzc+7mUuVGSwTTwqJYZJzL2l32u5azTLhC9/LtDg4IbFvTNAuQXtJ/WXculYFYgC/HRAICvzHiMce1MD6KYc8lPKJO5p2vo3YqKakLfRp8F57hvMfVxtAP9X8Rux+latN3KnqM1WLkfmOSXnbnKVxrs8mcRytoFjQ+U5g3qK7a0+eoPGP6qL7FJL+creqif4mdwWx6CsUAkM/A/mM1PcjlrcHesYyYey9xUJkQIDAQAB",
  "name": "Random Student Generator for Google Classroom",
  "icons": {
    "16": "icons/icon16.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "author": "Tristan Kirkpatrick - #GSuiteLikeAPro",
  "oauth2": {
    "scopes": [
      "profile",
      "https://www.googleapis.com/auth/classroom.courses.readonly",
      "https://www.googleapis.com/auth/classroom.rosters.readonly",
      "https://www.googleapis.com/auth/classroom.profile.photos"
    ],
    "client_id": "324446680830-7e8jeu6vglt2fjkb5337pupqbj58jgrc.apps.googleusercontent.com"
  },
  "version": "0.0.19",
  "background": {
    "scripts": [
      "background.js"
    ]
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Select a random student from your Google Classroom at the click of a button - keeping students engaged in learning.",
  "permissions": [
    "identity",
    "activeTab",
    "storage",
    "http://*/*",
    "http://*/",
    "https://*/"
  ],
  "browser_action": {
    "default_popup": "popup.html",
    "default_title": "Click here to generate a random student!"
  },
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' https://ssl.google-analytics.com; object-src 'self'"
}

by ✦ Astarte

Random Student Generator for Google Classroom

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (31 total):

Raw Manifest

Detections

Manifest Findings