Poshmark + Vinted Automation Chrome extension security report

This Chrome extension provides browser automation assistance for users who list products on both Poshmark and Vinted marketplaces. It helps streamline the cross-listing process by automating form-filling tasks directly within the official Poshmark and Vinted websites, with additional support through a hosted web interface. Technical Functionality: Dual-Platform Support: Poshmark Integration: Works on https://poshmark.com/create-listing Vinted Integration: Works on https://www.vinted.com/items/new Hosted Interface Components: Primary Web Panel for Vinted: https://clextensions-a6bvf6amfrc9aeex.centralindia-01.azurewebsites.net/vinted.html Testing Interface For Poshmark: https://clextensions-a6bvf6amfrc9aeex.centralindia-01.azurewebsites.net/test-panel.html These interfaces provide users with additional listing management tools and testing capabilities Browser Automation Features: Direct navigation to platform listing pages via extension buttons Automatic form field population for listing creation Cross-platform data synchronization assistance Local browser-based automation without external API calls Integration with hosted web panel for enhanced functionality Technical Implementation Details: Content Scripts: content.js: Poshmark-specific automation logic content-vinted.js: Vinted-specific automation logic Both scripts operate only on their respective domain URLs Host Permissions: Strictly limited to: https://poshmark.com/* https://vinted.com/* https://www.vinted.com/* https://clextensions-a6bvf6amfrc9aeex.centralindia-01.azurewebsites.net/* wss://clextensions-a6bvf6amfrc9aeex.centralindia-01.azurewebsites.net/* (for WebSocket connections) Local development endpoints for testing Manifest Compliance: Uses Manifest V3 Requests minimal required permissions No background service workers for data collection Explicit declaration of all connected endpoints User Workflow: User accesses extension popup with two buttons: "Open Poshmark" and "Open Vinted" Clicking either button navigates directly to the respective platform's listing creation page If not authenticated, user is redirected to platform login page User can optionally use the hosted web interface for listing preparation Extension facilitates automated form filling on the respective platform pages Privacy and Security: All processing occurs locally in user's browser No user data collection, storage, or transmission No access to user credentials or authentication tokens No interaction with platform APIs (uses only DOM manipulation) Works exclusively within authorized domains Connection to hosted interface uses secure HTTPS/WSS protocols Clear disclosure of all external endpoints in manifest permissions Intended Use Case: For sellers who maintain inventory on both Poshmark and Vinted marketplaces and wish to reduce manual data entry when creating duplicate listings. The extension assists with repetitive form-filling tasks while requiring manual user login and platform interaction as per normal workflow. Compliance Statements: This extension is not affiliated with, endorsed by, or sponsored by Poshmark Inc. or Vinted GmbH All trademark references belong to their respective owners Users must comply with Poshmark and Vinted Terms of Service Extension functionality depends on website DOM structure and may require updates if platforms change their interfaces Hosted interface is maintained separately and may have its own terms of use Developer Information: Regular updates for platform compatibility No user data logging or analytics collection Support available through extension interface and hosted panel Transparent functionality with no hidden features Clear disclosure of all external connections in manifest file