Avatar Maker StudioSecurity Analysis

Creates functions from strings, similar to eval(), often used to hide malicious code.

Dynamically sets a script's src attribute to load external code at runtime.

Injects and executes scripts in web pages programmatically.

Creates a function from a string (new Function()), similar to eval().

Sends messages via Chrome runtime, could communicate with external services.

Line exceeds 5000 characters (entropy: 5.690051894172654)

This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.

Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.

Content script matches <all_urls>, executing on every website the user visits.

Sets innerHTML directly, which can lead to XSS if used with untrusted data.