PDF Sign
Based on the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 10 months ago
- Version
- v1.0.0
- Artifact
- SHA256 CEF…A00
- Source
- Findings (non-IoC)
No Findings
All security checks passed
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
No Threats Detected
This extension passed all security checks
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The PDF Sign extension presents a low-risk profile despite 43 total findings. Of these, 28 are code-smell findings classified as low severity, which per CVEQ guidelines represent noise from basic JavaScript patterns (fetch, crypto, etc.) and should not drive verdicts. The 14 IoC findings are predominantly benign: clients2.google.com/service/update2/crx is Google's legitimate update service, www.google.com and Google search URLs are expected for a productivity tool, and wildcard PDF patterns (https://*/*.pdf, http://*/*.pdf) are consistent with the extension's stated purpose of signing PDF documents.
The extension's own service domain ext.aitools.band appears in uninstall and congrats endpoints, which is normal for a SaaS-backed extension. The www.pdf-editor.ai domain is related to the extension's functionality. The single network finding at js/background.js:4 shows a fetch call, which is expected for any extension communicating with a backend service.
The most concerning finding is the tab.id domain IoC. This domain is associated with browser tab tracking services and could indicate data collection beyond the extension's stated PDF signing purpose. However, without malware signatures, obfuscation, or evidence of credential theft, this single domain does not confirm malicious intent. It could be a bundled dependency or an innocent third-party integration.
Counterargument: A skeptic might argue that tab.id represents data exfiltration or browser hijacking behavior, especially combined with the anonymous Gmail developer ([email protected]). However, the absence of malware signatures (0 findings), obfuscation (0 findings), and the extension's behavior matching its stated purpose (PDF signing) outweighs this single suspicious domain. The developer's personal email is common for small productivity tools and does not indicate impersonation. The 654 user count is low but not alarming for a niche utility.
Conclusion: The findings are driven by known false-positive patterns (code-smell rules, generic IoC extraction). The extension appears to be a legitimate PDF signing tool with one potentially privacy-invasive dependency. No takedown action is warranted without additional evidence of malicious behavior.
Key Reasons
- Zero malware signatures and zero obfuscation findings
- 28 code-smell findings are documented noise patterns
- Most IoCs are benign (Google services, extension's own domain)
- Extension behavior matches stated PDF signing purpose
- Single suspicious domain (tab.id) insufficient for malicious verdict
False Positive Considerations
- Code-smell findings (28 low-severity matches on basic JS patterns)
- Benign Google/CDN domains in IoC extraction
- Wildcard PDF URL patterns matching extension functionality
- No malware signatures or obfuscation present
Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 72%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Image Converter
[email protected]
Spell Check
[email protected]
YouTube Transcript Generator
[email protected]
Find The Font
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]