Search Automator
The AI review rates the findings as likely false positive, but the risk score (53/100) still counts them.
Analysis record
- Analysed
- 7 months ago
- Version
- v0.0.1
- Artifact
- SHA256 038…DB8
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
Requested Permissions
7 permissionsFull access to Chrome DevTools debugging protocol
Access and modify data on every website you visit
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension 'Search Automator' (v0.0.1) by developer [email protected] triggers 340 total findings, but a detailed examination reveals these are overwhelmingly false positives from known CVEQ noise patterns.
IoC Findings Are Garbage: All 279 IoC detections are classic XIOC extractor false positives. The findings include property access chains misread as domains: event.target, alarm.name, collection.stream, work.help. These are JavaScript property chains, not network destinations. File names are misidentified as domains: application.java, xdebug.so, application.properties, objectarray.java. Infrastructure domains appear: registry-1.docker.io, maven.google.com, tf.app.run. None of these represent actual network connections to suspicious servers.
No Malware Signatures: The findings summary shows zero malware-signature findings and zero malware findings. This is critical—there is no evidence of actual malicious code, only code-smell patterns.
Code-Smell Is Expected Noise: The 57 code-smell findings are low severity and match the documented false-positive patterns (postinstall_*, credential_*, code-quality rules). These fire on almost any non-trivial JavaScript and should not drive a verdict.
Zero Obfuscation: No obfuscation findings were detected. The extension is not hiding its code.
The Counterargument: A skeptic might argue the extension's stated purpose—automating Bing searches for Microsoft Rewards—could be a PUP or browser hijacker. However, the security findings themselves provide no evidence of malicious behavior. There are no custom search engine domains, no history API manipulation, no credential access, and no suspicious network destinations. The extension's purpose is questionable from a policy perspective, but the security scan findings are clearly false positives.
Conclusion: This extension triggers findings due to known XIOC extractor garbage and code-smell noise patterns, not actual malicious behavior. The verdict is likely_false_positive with high confidence because every IoC finding can be explained as a false positive from the documented CVEQ noise sources.
Key Reasons
- All 279 IoC findings are property chains, file names, or infrastructure domains—not real suspicious domains
- Zero malware signatures detected
- Zero obfuscation findings
- Code-smell findings are low severity and match known FP patterns
False Positive Considerations
- XIOC-DOMAIN false positives (property chains like event.target, alarm.name)
- Infrastructure domains (registry-1.docker.io, maven.google.com)
- File names misidentified as domains (application.java, xdebug.so)
- Code-smell rules matching basic JavaScript patterns
Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
TM Launcher
[email protected]
ReColor
[email protected]
SaaS Stack Detector
[email protected]
Suggest Me a Password
[email protected]
Rewards Search Automator
[email protected]
Web Scraper - ScrapeMate
[email protected]