| declarativeNetRequestWithHostAccess | Permission | | This permission combines network request modification with host permissions. Rated Critical because it can modify requests for specific domains, potentially targeting sensitive websites with precise attack rules. |
| offscreen | Permission | | This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness. |
| Contextual Risk Factors | Risk Factor | | The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 10% increase: Early script execution enables pre-emptive content manipulation |
| storage | Permission | | This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads. |
| https://s3.us-west-2.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.us-west-1.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://us-south1-storage.googleapis.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.us-east-1.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.sa-east-1.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.eu-central-1.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.eu-west-2.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.ap-south-1.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.ap-southeast-1.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.ap-northeast-1.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://s3.ap-southeast-2.amazonaws.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://gamejoin.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://games.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://www.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://bloxpilot-subscriptions-live.customerreplytemplates.workers.dev/* | Host | | Host permission — access limited to this URL pattern. |
| https://apis.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://friends.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://presence.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://thumbnails.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://users.roblox.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://www.rolimons.com/* | Host | | Host permission — access limited to this URL pattern. |
| Access to Sensitive Domains | Risk Factor | | This extension requests access to sensitive domains: https://s3.us-west-2.amazonaws.com/*, https://s3.us-west-1.amazonaws.com/*, https://us-south1-storage.googleapis.com/*, https://s3.us-east-1.amazonaws.com/*, https://s3.sa-east-1.amazonaws.com/*, https://s3.eu-central-1.amazonaws.com/*, https://s3.eu-west-2.amazonaws.com/*, https://s3.ap-south-1.amazonaws.com/*, https://s3.ap-southeast-1.amazonaws.com/*, https://s3.ap-northeast-1.amazonaws.com/*, https://s3.ap-southeast-2.amazonaws.com/*, https://bloxpilot-subscriptions-live.customerreplytemplates.workers.dev/* |
| Early Content Script Execution | Risk Factor | | This extension runs content scripts at document_start. |
| alarms | Permission | | This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data. |
| notifications | Permission | | This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data. |