What our analysis found

Shinigami Eyes, used by 60,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by other. Its permissions mean it can read and change data on all websites.

Key findings

• high· other —The bundled manifest declares manifest_version 2, but the published CWS manifest summary shows manifest_version 3. This version mismatch may indicate an outdated extension version or a listing discrepancy. While not malicious, it could leave users with a deprecated manifest version lacking modern security controls.

The extension's behavior matches its description: it highlights trans-friendly and transphobic pages using a bloom filter dataset and allows users to submit labels. Data submission to a disclosed AWS backend () is consistent with the privacy policy and CWS-disclosed data collection (personally identifiable information, website content). No hidden tracking, code injection, or data exfiltration was found. The ML risk score was 0.00, indicating the model did not flag it. The risk-engine report flagged broad host permissions, but these are necessary for the content script to function on multiple social media sites. The only anomaly is a manifest version mismatch between the bundled manifest (v2) and the live CWS listing (v3), which is a finding but does not indicate malice.