Is "SheetLink: Sync Bank Transactions to Google Sheets" on Chrome Web Store Safe to Install?

[email protected] · chrome · v0.8.8

Stop exporting CSVs. SheetLink connects your real bank accounts directly to Google Sheets, Excel, CSV, Postgres, and SQLite — one click, privacy-first, built for spreadsheet-first workflows. Cheaper than Tiller. More private than YNAB. No proprietary app — just your Google Sheet. Manual Sync — You control exactly when data moves. No background bank access, ever. New: Max Tier — CLI & API Access For developers and power users: automate syncs via the sheetlink CLI. Pipe transactions to Postgres, SQLite, CSV, or JSON on any schedule. API key authentication for unattended workflows. New: Recipe Marketplace Choose from pre-built financial templates (Personal Budgeting, Business P&L, Cash Flow Analysis) that automatically set up your spreadsheet with the right structure and formulas. Build your P&L in 30 seconds instead of 30 minutes. ➤ What is SheetLink? SheetLink uses Plaid to securely connect to 10,000+ financial institutions and automatically sync transactions into your own Google Sheets. Ideal for spreadsheet-first workflows including personal finance, budgeting, financial analysis, and lightweight accounting. ➤ Key Features • Real Bank Connections — Connect checking, savings, and credit card accounts • One-Click Sync — Pull transactions directly into Google Sheets • Multi-Institution Support — Connect multiple banks and cards • Spreadsheet-First — Your Google Sheet is the system of record • AI-Enhanced Categorization (via Plaid) — Rich, source-level categories passed directly into your sheet • Recipe Marketplace — Install pre-built analysis scripts directly into your sheet (budget trackers, spending reports, category summaries, and more) • Community Recipes — Browse and install recipes built by the SheetLink community • CLI & API Access (Max) — Automate syncs via the sheetlink CLI. Pipe transactions to Postgres, SQLite, CSV, or JSON on any schedule • Privacy-First Architecture — We never store transaction data • Clean, Minimal UI — Built to stay out of your way ➤ Privacy & Security SheetLink uses a pass-through architecture. Transaction data flows from Plaid directly into your Google Sheet. We never store transaction history on our servers. What we do ✅ Encrypt Plaid access tokens (Fernet / AES-128 + HMAC) ✅ Authenticate via Google OAuth (JWT sessions) ✅ Support Google Workspace accounts (subject to admin permissions) ✅ Keep data flowing directly into your sheet What we never do ❌ Store transaction data ❌ Store banking credentials ❌ Share or sell your data ❌ Track or analyze your financial activity Privacy Policy: https://sheetlink.app/privacy Security Details: https://sheetlink.app/security ➤ How It Works 1. Sign in with Google 2. Connect your bank using Plaid 3. Link any Google Sheet you own 4. Click “Sync Now” 5. Analyze your data directly in Sheets 6. (Optional) Install a Recipe for automated analysis — budget trackers, spending breakdowns, and more, added directly to your spreadsheet's menu ➤ Recipe Marketplace Recipes are pre-built Google Apps Script functions that install directly into your spreadsheet. One click adds new menu items for automated analysis — no coding required. Official Recipes (maintained by SheetLink): • Monthly Spending Summary • Budget vs. Actual tracker • Category Breakdown Community Recipes: • Browse and install recipes contributed by the community Recipe code is open source and auditable on GitHub. ➤ Common Use Cases • Spreadsheet-first personal finance • Budgeting across multiple institutions • Financial analysis and modeling • Tax preparation and reconciliation • Business and contractor expense tracking • Accountant / CPA workflows using Sheets as source of truth • One-click automated analysis via Recipes (budgets, reports, summaries) • Software developer & contractor expense tracking (deductible tools, home office, subscriptions) ➤ Bank Support SheetLink supports 10,000+ institutions via Plaid, including major banks, credit unions, credit cards, investment accounts, PayPal, and Venmo. ➤ Plans & Data Access Free Tier • Up to 7 days of transaction history • Core transaction fields • Multiple bank connections • Manual sync • Full Google Sheets integration Pro Tier ($4.99/month · $39.99/year · cancel anytime) • Up to 2 years of transaction history • Expanded transaction metadata (dates, merchant details, location, categories) • Built for higher-volume and professional workflows Max Tier ($10.99/month · $99.99/year · cancel anytime) • Everything in Pro • API key authentication for unattended automation • CLI access (sheetlink sync) — pipe transactions to Postgres, SQLite, CSV, or JSON • Built for developers, power users, and scheduled workflows ➤ Requirements • Google account (personal or Workspace) • Plaid-supported bank account • Google Chrome (latest version) • A Google Sheet for storing transactions ➤ Support • Email: [email protected] • Docs: https://sheetlink.app/docs • User Guide: https://sheetlink.app/user-guide ➤ Permissions SheetLink requests only the permissions required to function: • storage — local preferences and session state • alarms — secure token refresh • googleapis.com — Google Sheets & Drive APIs • cdn.plaid.com — Plaid Link • api.sheetlink.app — SheetLink backend • script.googleapis.com — Apps Script API (required for Recipe installation only; requested on demand) --- Built for spreadsheet-first finance workflows. Website: https://sheetlink.app GitHub: https://github.com/sheetlink/extension

Risk Assessment

Analyzed
43.58
out of 100
MEDIUM

29 security findings detected across all analyzers

Chrome extension requesting 9 permissions

Severity Breakdown

0
Critical
0
High
29
Medium
0
Low
0
Info

Finding Categories

29
Network

Requested Permissions

9 permissions
identity

Access your identity and sign-in tokens

High
storage
Low
alarms
Low
https://www.googleapis.com/*
Low
https://script.googleapis.com/*
Low
https://raw.githubusercontent.com/*
Low
https://cdn.plaid.com/*
Low
https://api.sheetlink.app/*
Low
https://www.googleapis.com/auth/script.projects
Low

About This Extension

Stop exporting CSVs. SheetLink connects your real bank accounts directly to Google Sheets, Excel, CSV, Postgres, and SQLite — one click, privacy-first, built for spreadsheet-first workflows. Cheaper than Tiller. More private than YNAB. No proprietary app — just your Google Sheet. Manual Sync — You control exactly when data moves. No background bank access, ever. New: Max Tier — CLI & API Access For developers and power users: automate syncs via the sheetlink CLI. Pipe transactions to Postgres, SQLite, CSV, or JSON on any schedule. API key authentication for unattended workflows. New: Recipe Marketplace Choose from pre-built financial templates (Personal Budgeting, Business P&L, Cash Flow Analysis) that automatically set up your spreadsheet with the right structure and formulas. Build your P&L in 30 seconds instead of 30 minutes. ➤ What is SheetLink? SheetLink uses Plaid to securely connect to 10,000+ financial institutions and automatically sync transactions into your own Google Sheets. Ideal for spreadsheet-first workflows including personal finance, budgeting, financial analysis, and lightweight accounting. ➤ Key Features • Real Bank Connections — Connect checking, savings, and credit card accounts • One-Click Sync — Pull transactions directly into Google Sheets • Multi-Institution Support — Connect multiple banks and cards • Spreadsheet-First — Your Google Sheet is the system of record • AI-Enhanced Categorization (via Plaid) — Rich, source-level categories passed directly into your sheet • Recipe Marketplace — Install pre-built analysis scripts directly into your sheet (budget trackers, spending reports, category summaries, and more) • Community Recipes — Browse and install recipes built by the SheetLink community • CLI & API Access (Max) — Automate syncs via the sheetlink CLI. Pipe transactions to Postgres, SQLite, CSV, or JSON on any schedule • Privacy-First Architecture — We never store transaction data • Clean, Minimal UI — Built to stay out of your way ➤ Privacy & Security SheetLink uses a pass-through architecture. Transaction data flows from Plaid directly into your Google Sheet. We never store transaction history on our servers. What we do ✅ Encrypt Plaid access tokens (Fernet / AES-128 + HMAC) ✅ Authenticate via Google OAuth (JWT sessions) ✅ Support Google Workspace accounts (subject to admin permissions) ✅ Keep data flowing directly into your sheet What we never do ❌ Store transaction data ❌ Store banking credentials ❌ Share or sell your data ❌ Track or analyze your financial activity Privacy Policy: https://sheetlink.app/privacy Security Details: https://sheetlink.app/security ➤ How It Works 1. Sign in with Google 2. Connect your bank using Plaid 3. Link any Google Sheet you own 4. Click “Sync Now” 5. Analyze your data directly in Sheets 6. (Optional) Install a Recipe for automated analysis — budget trackers, spending breakdowns, and more, added directly to your spreadsheet's menu ➤ Recipe Marketplace Recipes are pre-built Google Apps Script functions that install directly into your spreadsheet. One click adds new menu items for automated analysis — no coding required. Official Recipes (maintained by SheetLink): • Monthly Spending Summary • Budget vs. Actual tracker • Category Breakdown Community Recipes: • Browse and install recipes contributed by the community Recipe code is open source and auditable on GitHub. ➤ Common Use Cases • Spreadsheet-first personal finance • Budgeting across multiple institutions • Financial analysis and modeling • Tax preparation and reconciliation • Business and contractor expense tracking • Accountant / CPA workflows using Sheets as source of truth • One-click automated analysis via Recipes (budgets, reports, summaries) • Software developer & contractor expense tracking (deductible tools, home office, subscriptions) ➤ Bank Support SheetLink supports 10,000+ institutions via Plaid, including major banks, credit unions, credit cards, investment accounts, PayPal, and Venmo. ➤ Plans & Data Access Free Tier • Up to 7 days of transaction history • Core transaction fields • Multiple bank connections • Manual sync • Full Google Sheets integration Pro Tier ($4.99/month · $39.99/year · cancel anytime) • Up to 2 years of transaction history • Expanded transaction metadata (dates, merchant details, location, categories) • Built for higher-volume and professional workflows Max Tier ($10.99/month · $99.99/year · cancel anytime) • Everything in Pro • API key authentication for unattended automation • CLI access (sheetlink sync) — pipe transactions to Postgres, SQLite, CSV, or JSON • Built for developers, power users, and scheduled workflows ➤ Requirements • Google account (personal or Workspace) • Plaid-supported bank account • Google Chrome (latest version) • A Google Sheet for storing transactions ➤ Support • Email: [email protected] • Docs: https://sheetlink.app/docs • User Guide: https://sheetlink.app/user-guide ➤ Permissions SheetLink requests only the permissions required to function: • storage — local preferences and session state • alarms — secure token refresh • googleapis.com — Google Sheets & Drive APIs • cdn.plaid.com — Plaid Link • api.sheetlink.app — SheetLink backend • script.googleapis.com — Apps Script API (required for Recipe installation only; requested on demand) --- Built for spreadsheet-first finance workflows. Website: https://sheetlink.app GitHub: https://github.com/sheetlink/extension

Detailed Findings

29 total

AI Security Report

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is benign but powerful with 82% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 44/100.
Evidence context: threat category none; evidence quality moderate.

This extension, "SheetLink: Sync Bank Transactions to Google Sheets," presents 29 network findings across files including src/popup.js, src/service_worker.js, src/sheets.js, src/drive.js, and src/recipes/fetcher.js. All findings are NET-FETCH type detections indicating standard HTTP fetch() calls. This behavior aligns directly with the extension's stated purpose: syncing bank transactions via Plaid API to Google Sheets, CSV, and Postgres databases.

The network activity is distributed across functional modules: src/service_worker.js handles background synchronization, src/sheets.js manages Google Sheets API interactions, src/drive.js handles Google Drive operations, and src/recipes/fetcher.js appears to manage data fetching workflows. These are expected implementation patterns for a financial data synchronization tool.

Critically, the findings summary shows zero malware signatures, zero obfuscation findings, zero suspicious IoCs, and zero code-smell detections. The only findings are medium-severity network calls, which are inherent to the extension's core functionality. No typosquatting indicators are present—the extension name "SheetLink" is distinctive and not mimicking any known popular extension. The developer attribution [email protected] provides a verifiable contact point.

The strongest counterargument would be that the extension accesses sensitive financial data via Plaid, which could theoretically be weaponized for credential theft or data exfiltration. However, there is no evidence of this in the findings: no suspicious external domains beyond expected API endpoints, no obfuscation hiding malicious payloads, no malware signatures, and no credential-stealing patterns. The extension's behavior is consistent with legitimate fintech applications that use Plaid's API for authorized bank data access. If this were malicious, we would expect to see suspicious IoC domains, obfuscation patterns, or malware signatures—none of which appear in the evidence.

The low user count (125) and email-based developer attribution warrant monitoring but do not indicate malicious intent. This is a niche financial tool with appropriate permissions for its stated functionality.

Key Reasons

  • All 29 findings are legitimate network calls for stated functionality
  • Zero malware signatures or obfuscation detected
  • No suspicious IoC domains identified
  • Extension behavior matches declared purpose (Plaid + Google Sheets sync)
  • No typosquatting or impersonation indicators

False Positive Considerations

  • generic fetch() detection in legitimate API calls
  • network findings expected for fintech functionality

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

Ship Xanh copy sản phẩm, nhân bản shop, hiển thị % phí sàn, lượt bán tháng

[email protected]

CRITICAL 20K users

SVG to AVIF Converter [ShiftShift]

[email protected]

CRITICAL 4 users

ChromeCompare

[email protected]

CRITICAL 16 users

CAI Tools

[email protected]

CRITICAL 40K users

Auto Gmail - ChatGPT AI for email inbox

[email protected]

CRITICAL 1K users

EC Seller Tools

[email protected]

CRITICAL 1K users