Is "Sermon Notetaker" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive.
Risk context: MEDIUM risk, score 53/100.
Evidence context: threat category none; evidence quality moderate.

The Sermon Notetaker extension demonstrates a clean security profile with no evidence of malicious behavior. The four findings in the evidence bundle are all medium-severity items that directly support the extension's stated purpose of capturing sermon audio and generating AI summaries.

The MANIFEST-SENSITIVE-PERM-TABS finding in manifest.json declares the 'tabs' permission, which is necessary for an extension to access audio from browser tabs. Without this permission, the extension cannot capture sermon audio from web pages. This is expected behavior for the described functionality.

The three network findings (NET-FETCH-background.js-160, NET-FETCH-offscreen.js-83, NET-FETCH-background.js-233) detect generic fetch calls in background.js and offscreen.js. These network operations are required to transmit captured audio data to an AI service for summarization. Critically, the findings do not identify any suspicious destination domains. The evidence shows zero IoCs, meaning no specific external domains were extracted from these network calls. This absence of suspicious domains distinguishes these findings from actual data exfiltration patterns.

The findings summary confirms zero malware signatures, zero obfuscation findings, zero code-smell detections, and zero suspicious IoCs. These are the categories that typically indicate malicious behavior. The complete absence of findings in these categories is strong evidence of benign code.

The strongest counterargument to this verdict would be that the developer uses a personal Gmail address ([email protected]) rather than a verified organization, and the extension has only 1 user, suggesting it could be a testbed for malicious code. However, developer identity alone does not determine maliciousness. The actual code analysis shows no obfuscation, no malware signatures, no suspicious network destinations, and no credential access patterns. Personal Gmail addresses are common for legitimate independent developers and small projects. The low user count indicates a new or niche extension, not necessarily malicious intent. Without evidence of actual harmful behavior in the code, the developer's email address is insufficient grounds for a malicious verdict.

This extension's findings profile matches known false-positive patterns where generic network detection rules trigger on legitimate fetch operations. The verdict is likely_false_positive because the findings are explainable by the extension's documented functionality and lack any specific indicators of malicious intent.

Key Reasons

• Zero malware signatures detected in any file
• Zero obfuscation findings across all code
• Zero suspicious IoCs or external domains extracted
• Tabs permission is necessary for audio capture functionality
• Network fetch calls lack suspicious destination domains

False Positive Considerations

• Generic network fetch detection on legitimate API calls
• Sensitive permission flagged without contextual analysis
• Small/new extension with limited codebase