Sonbelt Video Chrome extension security report

The extension has two functions that monitor the Hudl video player. One of them grabs the timestamp and the other automatically starts and stops the video based on links at Sonbelt.com. It allows accurate recording of transaction times for basketball analytics. Sonbelt Video connects Sonbelt Analytics basketball scouting pages to Hudl video. It captures the current Hudl video timestamp for use during live stat entry, and seeks the Hudl player to a specific possession when a coach clicks a row in the Possession Map report. hudl.com is required to inject the content scripts that read the video player timestamp and control playback seek. sonbelt.com and localhost are required to inject the script that intercepts possession map link clicks and sends seek commands to the Hudl tab. The scripting permission is used to probe the Hudl video player for its current timestamp when the content script heartbeat is unavailable. This is necessary because Hudl's video player (THEOplayer) is only accessible from the page's main JavaScript context, requiring a scripting injection to read the current time. Storage is used to persist the active video tab ID and the most recent video timestamp across service worker restarts. No user data is transmitted externally. All stored data remains local to the browser. The tabs permission is used to locate the open Hudl tab so that possession map seek commands from the scouting page can be forwarded to the correct tab. No tab content or browsing history is read or stored. This extension does not execute any remote code. All JavaScript is bundled locally within the extension package. No external scripts are fetched or evaluated at runtime.