QuizShot – AI Math Solver, Homework Helper & Study Assistant Tutor

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality moderate.

The QuizShot extension shows 2389 total findings, but the nature of these findings indicates systematic false positives rather than actual malicious behavior. The 2284 IoC findings include classic XIOC extractor garbage: property access chains misidentified as domains (me.call, rt.call in the IoC list), and extremely short generic strings (o.th, u.tr, h.ba, m.ax) that are characteristic of hex substrings from minified JavaScript being misread as TLDs.

Zero malware signatures were detected in any file. The single obfuscation finding is insufficient to indicate malicious intent without corroborating evidence. The 87 code-smell findings fall into the documented noise category—rules like postinstall_*, credential_*, and code-quality checks that fire on almost any non-trivial JavaScript. The 16 network findings lack specific suspicious domains in the provided evidence.

The developer attribution uses an email address ([email protected]) rather than a company name, which is a minor trust signal but not inherently suspicious. The extension's stated purpose (AI math solver and homework helper) aligns with its name and description. The 17 user count indicates this is a new or niche extension, not a widely deployed threat.

The strongest counterargument would be the sheer volume of 2284 IoC findings, which might suggest hidden malicious infrastructure. However, the CVEQ platform's own documentation confirms that IoC COUNT alone is meaningless and that the XIOC extractor produces massive false-positive volumes from property access chains and minified code artifacts. The specific domains listed (me.call, rt.call) are textbook examples of this known false-positive pattern. Without malware signatures, without specific suspicious domains (like custom search engines, credential harvesting endpoints, or known C2 infrastructure), and with the finding profile matching documented false-positive patterns, the high count reflects extraction noise rather than actual threat indicators.

Key Reasons

• Zero malware signatures detected across all files
• IoC findings match known XIOC false-positive patterns (property access chains like me.call, rt.call)
• Generic short domains (o.th, u.tr, h.ba) are characteristic of hex substring misreads from minified code
• Code-smell findings (87) are documented noise for non-trivial JavaScript
• Extension category matches stated functionality with no behavioral mismatch

False Positive Considerations

• XIOC property access chain misreads (me.call, rt.call)
• Minified JavaScript hex substrings misidentified as domains
• Code-smell YARA rules firing on standard patterns
• IoC volume inflation from bundled code extraction