ToS Radar Chrome extension security report

ToS Radar is a Chrome browser extension (Manifest V3) that automatically analyzes Terms of Service agreements and privacy policies when you visit them, flagging concerning clauses using Google's Gemini AI. How It Works 1. Automatic Detection (`content.js`): When you navigate to a page whose URL or title matches patterns like "terms-of-service", "tos", "privacy-policy", etc., the content script extracts the page's main text content (up to 15,000 characters). 2. AI Analysis (`background.js`): The extracted text is sent to the background service worker, which calls the **Gemini 1.5 Flash API** to analyze it for six categories of concerning clauses: - Arbitration waivers (giving up the right to sue) - Data selling/sharing with third parties - Automatic renewal without notice - Unilateral changes to terms - Content ownership/rights grabs - Cancellation difficulty 3. Results & Badge: The AI returns a risk score (1-10), a list of red flags with severity levels (high/medium/low), and a plain-English summary. The extension displays a colored badge on the toolbar icon (green for low risk, orange for medium, red for high) and caches results per domain. 4. Popup UI (`popup.html`, `popup.js`, `popup.css`): Clicking the toolbar icon opens a popup showing the risk score badge, the summary, and each flagged clause with its type, description, and severity color-coding. Key Technical Details - API: Uses Google Gemini 3.5 Flash with a hardcoded API key - Caching: Results are cached both in-memory (Map) and persisted to `chrome.storage.local` per domain - Retry Logic: The popup retries up to 5 times (with 1-second delays) to wait for analysis to complete - Permissions: Requires `activeTab` and `storage` permissions, plus `<all_urls>` host permission for content script injection - No user configuration: The API key is embedded directly in the source code, and there's no settings UI Architecture ``` content.js → detects ToS pages, extracts text ↓ background.js → calls Gemini API, caches results, updates badge ↓ popup.html/js → displays risk score, flags, and summary ```