Is "Smart Page Annotator" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 78% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 53/100.
Evidence context: threat category none; evidence quality weak.

The Smart Page Annotator extension (version 1.1.0) presents a clean security profile with no evidence of malicious behavior. The extension's stated purpose—highlighting webpages, reviewing PDFs, sketching, and adding notes—aligns with its technical implementation.

Manifest Analysis: The single manifest finding (MANIFEST-SENSITIVE-PERM-TABS in manifest.json) indicates the extension requests the 'tabs' permission. This is a legitimate requirement for an annotation tool that needs to read and modify page content. The tabs permission alone does not indicate malicious intent; it is standard for productivity extensions.

Network Activity: Seven network findings were detected across popup.js (lines 1 and 7), content.js (lines 4 and 41), workspace.js (lines 4 and 41), and diagram.js (line 116). All findings are generic 'fetch' call detections without specific domain information. These represent normal HTTP requests that any extension with backend functionality would make. Critically, there are zero IoC findings—no suspicious domains, no custom search engine domains, and no data exfiltration endpoints were extracted from the code.

Absence of Malicious Indicators: The findings summary shows zero malware signatures, zero obfuscation findings, zero code-smell findings, and zero secret findings. This is significant because actual malicious extensions typically exhibit at least one of these characteristics. The lack of obfuscation combined with the lack of malware signatures strongly indicates benign code.

Counterargument: A skeptic might argue that the anonymous developer email ([email protected]) and extremely low user count (5 users) warrant caution. While these factors reduce trust, they do not constitute evidence of malicious behavior. Many legitimate extensions are published by individual developers using Gmail addresses, and low user count simply indicates a niche or new extension. Without specific evidence of harm—suspicious domains, credential access patterns, or malware signatures—the extension should not be flagged as malicious based on publisher anonymity alone.

Conclusion: The findings represent expected behavior for a functional annotation extension. No actionable threats were identified.

Key Reasons

• Zero malware signatures detected
• Zero suspicious domains in IoC findings
• Zero obfuscation findings
• Network activity is generic fetch calls without specific endpoints
• Extension functionality matches stated description

False Positive Considerations

• Generic network findings (fetch calls without domain specifics)
• Manifest permission findings (tabs permission is legitimate for annotation tools)