Is AI Auto Form Filler (BYOK) safe to use?

AI Auto Form Filler (BYOK) has a security risk score of 59.84/100 (MEDIUM risk). Our security analysis detected 112 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of AI Auto Form Filler (BYOK)?

Based on our automated security analysis, AI Auto Form Filler (BYOK) presents medium risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Firefox Add-ons Verified

AI Auto Form Filler (BYOK)

Name: AI Auto Form Filler (BYOK)
Availability: InStock
Author: Dracon

by Dracon · 1 users

72ec1bd3-ec75-5441-9385-6376dc65872e | v2.3.2

MEDIUM risk

No change since v2.3.1

Analyst verdict

Needs follow up

From the RiskyPlugins AI security review of the observed evidence.

Analysis record

Analysed: 4 days ago
Version: v2.3.2
Artifact: SHA256 2B8…40C
Source: Findings (non-IoC)

Is AI Auto Form Filler (BYOK) safe?

AI Auto Form Filler (BYOK) declares no special permissions and no host permissions. Its listed network names include dracon.uk, nodefilter.show, ut.info, and ko-fi.com. The code has fetch findings in background.js:6:0 and chunks/testConnection-CKt0YMlk.js:1:0, plus a socket finding in content-scripts/content.js:212:0. These details describe connections the extension can make through its own code, without a manifest permission string granting broad site or cookie access.

The main warning is OBFUSCATION-UNICODE_HEAVY-chunks/options-C8ugsTKv.js-1 in chunks/options-C8ugsTKv.js:1:0. If that match comes from hidden code or encoded settings, it would make the extension's behavior harder to inspect. The listed results contain no malware-signature match, so the Unicode finding needs context from the source file and the network requests.

The extension has a small declared access surface, and dracon.uk matches the developer name Dracon. The scanner still found unfamiliar destinations at nodefilter.show and ut.info, along with socket activity in content-scripts/content.js:212:0. Those findings leave the extension's network behavior unresolved; a runtime check would show which requests run during form filling and what data they carry.

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

73 detail rows

YARA Rule Matches

12 rules

Severity	Rule	Hits	Files	Metadata
LOW	`postinstall file download`	6	content-scripts/content.jsbackground.jschunks/testConnection-CKt0YMlk.js +3 more	-
LOW	`SQLInjection`	1	content-scripts/content.js	-
LOW	`NoUseWeakRandom`	3	content-scripts/content.jsbackground.jschunks/popup-DsQikn2O.js	-
LOW	`postinstall crypto operations`	3	chunks/options-C8ugsTKv.jscontent-scripts/content.jsbackground.js	-
LOW	`postinstall system command`	19	content-scripts/content.jsassets/shared-tokens.cssassets/practice-form-B6vPOuNf.css +16 more	-
LOW	`postinstall file manipulation`	12	chunks/welcome-oT9IV_PH.jsoptions.htmlassets/options-erNFJZ8M.css +9 more	-
LOW	`postinstall environment access`	3	chunks/popup-DsQikn2O.jschunks/style-D6McMGC4.jschunks/options-C8ugsTKv.js	-
LOW	`postinstall obfuscation`	3	content-scripts/content.jsbackground.jschunks/practiceForm-CpD0THMb.js	-
LOW	`postinstall network communication`	14	chunks/welcome-oT9IV_PH.jschunks/style-D6McMGC4.jsoptions.html +11 more	-
LOW	`credential metamask extension`	1	chunks/popup-DsQikn2O.js	-
LOW	`credential env files`	1	content-scripts/content.js	-
LOW	`postinstall persistence mechanism`	2	content-scripts/content.jsbackground.js	-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

39 total

...

Network indicators are queued for lazy loading

Scroll this section into view to load the detailed rows.

Publisher Evidence

Limited evidence

Dracon

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Firefox does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

Noisy-finding weight

x1.00

Publisher domain

dracon.uk

Observed

Store verification signal

Limited signal

Limited

Extension portfolio

Portfolio

12 evidence rows available.

Finding Categories

Obfuscation

Network

IoC Indicators

YARA Rules Matched

12 rules(68 hits)

postinstall file download SQLInjection NoUseWeakRandom postinstall crypto operations postinstall system command postinstall file manipulation postinstall environment access postinstall obfuscation postinstall network communication credential metamask extension credential env files postinstall persistence mechanism

Requested Permissions

3 permissions

activeTab

Medium

storage

Low

scripting

Low

AI Security Report

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

AI Auto Form Filler (BYOK) is presented as a form-filling tool, and the name identifies a bring-your-own-key design. The manifest data lists no permissions and no host permissions, which limits the browser access visible in this review. The code still contains network activity: NET-FETCH-background.js-6 points to background.js:6:0, NET-FETCH-chunks/_virtual_wxt-html-plugins-DPbbfBKe.js-1 points to chunks/_virtual_wxt-html-plugins-DPbbfBKe.js:1:0, and NET-FETCH-chunks/testConnection-CKt0YMlk.js-1 points to chunks/testConnection-CKt0YMlk.js:1:0. NET-SOCKET_IO-content-scripts/content.js-212 also identifies socket activity at content-scripts/content.js:212:0.

The network names need attention because nodefilter.show, ut.info, and dracon.uk are listed alongside familiar development or service names such as svelte.dev, wxt.dev, mozilla.com, ko-fi.com, and www.roboform.com. The endpoint list alone does not show what data is sent, whether these hosts belong to the developer, or whether they are loaded during normal form filling. dracon.uk matches the developer name Dracon, while the supplied data gives no ownership detail for nodefilter.show or ut.info. Runtime capture of requests from background.js:6:0, chunks/testConnection-CKt0YMlk.js:1:0, and content-scripts/content.js:212:0 would resolve that gap.

The clearest code concern is OBFUSCATION-UNICODE_HEAVY-chunks/options-C8ugsTKv.js-1 at chunks/options-C8ugsTKv.js:1:0. A Unicode-heavy pattern can come from compressed or generated application code, yet this finding does not identify the characters, their purpose, or any linked behavior. The file is named options, so a check of its readable source and decoded strings should establish whether the pattern belongs to interface text, configuration handling, or concealed logic. The listed scan results contain no malware-signature or tool-poisoning finding, and the concrete alerts are limited to the network and Unicode findings named above.

A skeptic could point to the empty permission lists and the BYOK name as signs of a small, privacy-focused utility. That case is supported by the absence of browser permissions and by the developer-linked endpoint dracon.uk. It does not resolve the separate nodefilter.show and ut.info destinations, the socket alert in content-scripts/content.js:212:0, or the Unicode-heavy match in chunks/options-C8ugsTKv.js:1:0. Those items leave intent and data handling unclear, so a clean verdict would go beyond the supplied evidence. Runtime network inspection and source review are the direct ways to settle the ambiguity.

Key Reasons

OBFUSCATION-UNICODE_HEAVY-chunks/options-C8ugsTKv.js-1 flags Unicode-heavy content in chunks/options-C8ugsTKv.js:1:0.
NET-SOCKET_IO-content-scripts/content.js-212 identifies socket activity at content-scripts/content.js:212:0.
Fetch findings in background.js:6:0 and chunks/testConnection-CKt0YMlk.js:1:0 need request-level review.
nodefilter.show and ut.info are listed network destinations without ownership or purpose details.
No permissions or host permissions are declared, and no malware-signature finding is listed.

False Positive Considerations

The Unicode-heavy match in chunks/options-C8ugsTKv.js:1:0 may result from generated or compressed application code.
The fetch findings in background.js:6:0 and chunks/testConnection-CKt0YMlk.js:1:0 can fit a connection-test or service-backed form filler.
The network list includes development and service domains such as svelte.dev, wxt.dev, and mozilla.com.
The extension declares no permissions or host permissions, limiting the access shown in the manifest.

Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 76%.

Firefox version history

Risk trend by version

4 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected

Change since first

Change from previous

No change

Versions:

First analyzed version

2.2.0

May 30, 2026

Risk range

56 to 60

Across analyzed versions

Latest analyzed version

2.3.2

Sep 27, 2026

Selected version

medium

Version

v2.3.2

4 days ago

Risk score

Findings

112

Change vs previous

Pick any point on the chart to explore that version's code below.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

About This Extension

AI Auto Form Filler (BYOK) uses Google's powerful Gemma 3 AI to intelligently complete web forms for you. Just provide a little context, and watch as the AI fills fields accurately and instantly. Key Features 🤖 AI-Powered Filling — Uses Google's Gemma 3 27B model to understand form context and fill fields intelligently. Not just copy-paste — actual understanding of what each field needs. 👤 Multiple Profiles — Create custom profiles for different scenarios: job applications, shopping accounts, contact forms, event registrations. Each profile can have unlimited custom fields. 🔒 Privacy First — Your API key stays in your browser. Profile data never leaves your device. Direct API calls to Google — no middleman. Open source. ⚡ Lightning Fast — Detects form fields automatically. Fills forms in seconds. 14,400 free requests per day with Google AI Studio. Undo any fill with one click.