This extension shows concerning patterns that may indicate risky behavior. Proceed with caution.
This extension shows significant risk signals. Review the findings below carefully before installing or continuing to use it.
Based on 23 permissions including high-risk ones, 167 code findings, 2 dangerous combinations.
Extension intercepts network traffic and sends data externally — potential man-in-the-middle behavior.
Extension has access to all sites and captures keyboard input — behavior consistent with a keylogger.
3 libraries detected
This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.
Resolved from __MSG_* i18n placeholders:
Name: Merlin - Ask AI to Research, Write & Review
Description: 26-in-1 Chrome extension to Research, Re-write, and Summarise content on any website
JavaScript files are accessible to ALL websites. Any page can load and interact with these scripts, enabling web→extension attacks.
Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.
JavaScript files are accessible to ALL websites. Any page can load and interact with these scripts, enabling web→extension attacks.
Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
JavaScript files are exposed as web-accessible resources. Matched websites can load and interact with extension scripts.
Extension accepts messages from 4 external pattern(s). Verify these are trusted origins.
Content script matches <all_urls>, executing on every website the user visits.
Content script matches <all_urls>, executing on every website the user visits.
Content script matches <all_urls>, executing on every website the user visits.
Content script matches <all_urls>, executing on every website the user visits.
Content script matches <all_urls>, executing on every website the user visits.
28 indicators of compromise found