Chinna Chrome extension security report

Chinna is a local-first Chrome side-panel browser agent. Describe a task in plain English. Sign in to Chinna-assistant, then Chinna clicks, types, and navigates inside the tabs you already signed into — Vercel, Gmail, GitHub, dashboards, docs, and more — with evidence before every success claim. Sign in with Google on Chinna-assistant. Your plan selects the model (Free uses Luna; Pro auto-mixes Terra and Sonnet; Studio and Enterprise can pick). Studio, Elite, and Enterprise can Speak to run the browser by voice. Workspace: https://chinna-assistant.vercel.app Install guide: https://chinna-assistant.vercel.app/extension Privacy: https://chinna-assistant.vercel.app/extension-privacy WHAT CHINNA IS Chinna is not only a page summarizer. It is a Manifest V3 side-panel agent that can: • Read compact snapshots of the pages you choose to expose • Compare extra tabs you attach with @ • Plan a multi-step browser job • Click, type, scroll, navigate, and wait with validated tools • Show an animated pointer so you can watch every move • Pause for approval on consequential actions • Stop immediately (toolbar Stop or Alt+Shift+S) • Hand control back for CAPTCHA, OTP, passkeys, and reauth • Verify page state before claiming the job is done It uses your real Chrome session. If you are already signed into a site, Chinna uses that session. There is no headless login theater. WHAT YOU GET • Authenticated-tab automation • Ask before acting, or Act with guardrails • Teach Chinna: record, save, and replay workflows • Skills and slash commands (/slug) for repeatable jobs • Scheduled visual digests while Chrome is open • Inspect & export: colors, type, assets, and a 1:1 clone prompt • Screenshots and vision when you grant all-sites access • Speak (Studio / Elite / Enterprise): talk in the side panel; Chrome asks for the microphone on the page, once • Human takeover for CAPTCHA, OTP, passkeys, and reauth • Local storage — no Chinna telemetry SDK SETUP 1. Install Chinna and pin it. 2. Open the side panel (toolbar icon or Alt+Shift+C). 3. Choose Continue with Chinna and sign in with Google. 4. Grant site access when Chrome asks (needed for screenshots and page tools). 5. Describe a task. Start with Ask before acting the first time. 6. For Speak, look at the tab and allow the microphone when Chinna asks there. If you are not signed in, the side panel asks you to Continue with Chinna. PRIVACY Conversations, workflows, skills, schedules, and audit logs stay in chrome.storage.local on your device. When you run a task, Chinna may send your prompt, a compact page snapshot, optional screenshots, and tool context to Chinna-assistant to plan actions. Destination sites see the same authenticated actions you would perform yourself. Incognito capture is off by default. Uninstalling the extension removes its local storage for that Chrome profile. Do not paste secrets into prompts. Leave screenshots off on pages with passwords, bank data, or health records unless you accept that risk. Full policy: https://chinna-assistant.vercel.app/extension-privacy PERMISSIONS (WHY THEY EXIST) • sidePanel — the Chinna UI • tabs / tabGroups — find and activate your tabs • scripting — observe pages and perform approved clicks and typing • storage — save chats, settings, and workflows locally • alarms — scheduled digests while Chrome is open • activeTab — current tab when you open Chinna • downloads — download tools you request • notifications — digest and task alerts • https://chinna-assistant.vercel.app/* — sign in and call the Chinna model gateway • optional http://*/* , https://*/* , and <all_urls> — only after you grant site access for screenshots and automation • microphone (on the page, when you use Speak) — transcribe what you say with your signed-in session There is no remote code. The package is static. Planning goes to Chinna-assistant. LIMITS • Chrome 116+ • Chinna does not bypass CAPTCHA or OTP • Scheduled tasks need Chrome and Chinna running • Specialized adapters today: Vercel, Gmail, GitHub — generic accessibility elsewhere • This is a power-user agent, not magic KEYBOARD • Alt+Shift+C — open the side panel • Alt+Shift+S — stop the current run EXAMPLE JOBS • Summarize this page and list the three actions I can take next. • Audit the UX of this dashboard. Call out spacing, contrast, and confusing CTAs. • Compare these two invoice tabs and explain the delta. • Extract brand colors and a 1:1 clone prompt (Inspect & export). • Record how I invite a teammate, save it as a skill, and replay it with {{email}}. • Watch this status URL every morning and notify me only if the pixel baseline changes. • Open my signed-in Gmail draft, paste the summary, and stop before Send. Always start cautious. Chinna asks before sending, paying, or publishing when the policy says so. FAQ Do I need an API key? No. Sign in at https://chinna-assistant.vercel.app with Google. Is this the same as the website? The website is the full workspace. The extension is the browser agent. One Google account for both. Can it use Gmail / Vercel / GitHub? Yes, if those tabs are already signed in. Grant site access when asked. Will it send email or spend money on its own? Not without your confirmation policy. Does it work offline? Planning needs the Chinna-assistant gateway. Local chats stay on the device. Dashboard: https://chinna-assistant.vercel.app Chat: https://chinna-assistant.vercel.app/chat Extension: https://chinna-assistant.vercel.app/extension Privacy: https://chinna-assistant.vercel.app/extension-privacy Describe the job. Approve the plan. Watch the pointer. Verify the result.