Is "AttentionShield - Focus & Productivity" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-29. The review verdict is likely false positive with 78% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 53/100.
Evidence context: threat category none; evidence quality moderate.

The AttentionShield extension demonstrates no evidence of malicious behavior. All three findings are generic patterns that appear in legitimate productivity extensions.

The manifest.json file declares a 'tabs' permission (MANIFEST-SENSITIVE-PERM-TABS), which is standard for focus and productivity extensions that need to track active tabs to help users manage distractions. This permission enables the extension's core functionality as described in its purpose.

The network findings in assets/index-8A9SAuaI.js detect socket.io (NET-SOCKET_IO) and fetch (NET-FETCH) API usage. These are standard JavaScript networking libraries used for legitimate purposes including real-time communication, analytics, or device synchronization. No specific suspicious domains appear in the evidence—the findings only indicate that network APIs exist, not that they contact malicious infrastructure.

Zero malware signatures were detected. Zero obfuscation findings were identified. Zero suspicious IoCs (domains, IPs, URLs) were extracted. The findings_summary confirms 0 ioc, 0 malware-signature, 0 malware, and 0 obfuscation findings.

The extension's developer attribution ([email protected]) uses a personal Gmail address rather than a verified publisher identity, which is common for smaller extensions but reduces accountability. User count is 0, indicating either a newly published extension or one with minimal adoption.

Counterargument: A skeptic would point to the discrepancy between the extension's description claiming "all data stored locally" and the presence of network API calls in assets/index-8A9SAuaI.js. This inconsistency could indicate undisclosed data transmission. However, network API presence alone does not prove data exfiltration. Socket.io and fetch are used for legitimate purposes including crash reporting, usage analytics, or optional cloud sync features. Without evidence of specific suspicious domains, credential access patterns, or obfuscation, this discrepancy represents a documentation issue rather than malicious behavior. The absence of malware signatures and suspicious IoCs confirms no malicious infrastructure is present.

The verdict is likely_false_positive because all findings are generic patterns that appear in legitimate extensions. The scoring system is known to inflate risk based on finding counts rather than finding nature. Three medium-severity findings with zero critical/high severity and zero malware indicators does not constitute evidence of harm.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation findings present
• Zero suspicious IoCs or domains extracted
• Network findings are generic JavaScript API usage (socket.io, fetch)
• Tabs permission is appropriate for productivity extension functionality

False Positive Considerations

• Generic network API detection (socket.io and fetch are standard JavaScript libraries)
• Tabs permission is legitimate for focus/productivity extensions
• No malware signatures or obfuscation present
• No suspicious domains in IoC extraction