AIWise — Claude & Gemini Usage, Quota Tracker & Bookmarks

AI Security Review

Evidence context: threat category none; evidence quality moderate.

AIWise puts a battery-style meter for Claude and Gemini quota in the browser toolbar. The manifest declares no permissions and no host permissions, which is unusual for something that reads usage from a web page and worth stating plainly: the extension has no standing access to tabs, cookies, history or downloads. The four endpoints recorded are claude.ai, tailwindcss.com, wxt.dev and sensortower.com. claude.ai is the service being measured. tailwindcss.com and wxt.dev are the documentation domains for Tailwind CSS and WXT, the two build tools this extension is built with, and they show up because bundled chunks carry their URLs.

The network findings line up with that job. background.js line 5 opens a fetch, which is the poll for current quota. content-scripts/usage-capture.js line 1 fetches, and the filename says what it captures: usage numbers from the AI pages the user has open. content-scripts/usage-widget.js lines 1 and 2 fetch and match a socket.io reference, and that file also draws the meter. Two of the seven network hits are labelled NET-SOCKET_IO, one in chunks/theme-D60_OiDT.js line 13 and one in the widget. socket.io is a library name; a string match on it is not proof of a live bidirectional channel, and neither file connects to a host outside the four endpoints listed.

The single high-severity item is OBFUSCATION-UNICODE_HEAVY-content-scripts/usage-widget.js-1. That file is the widget renderer. A battery meter needs glyphs for bars, ticks and status icons, and Unicode-heavy is exactly what a file like that looks like. There is no encoding step, no packed payload, and no malware signature anywhere in the extension. The other 40 findings are low-severity code-smell rules that match ordinary JavaScript: fetch calls, exec patterns, environment variable reads. They carry no behavioural weight on their own.

A skeptic has two reasonable objections. The first is sensortower.com, a mobile app analytics company with no visible role in tracking AI quotas, and it does not belong in a list with claude.ai and two build-tool docs. The second is the socket.io match, since a persistent channel would let the extension receive instructions from a server. Both are worth a direct question to [email protected]. Neither is evidence of harm: the extension declares no permissions, matched zero malware signatures, and the endpoints it does contact are the service it monitors plus the developer's own toolchain documentation.

What would change this reading: a manifest version that adds host_permissions for broad site access, a fetch to a domain registered recently or unrelated to quota tracking, or an obfuscated payload in a file that also carries a malware signature. None of that is present in version 0.4.0, which has 41 users and a developer contact in the manifest.

Key Reasons

• Zero malware signatures across all 61 findings, with no malware or manifest-analysis categories populated
• Manifest declares no permissions and no host permissions, so the extension has no standing access to tabs, cookies or history
• The four recorded endpoints are claude.ai (the measured service) plus tailwindcss.com and wxt.dev (build-tool documentation bundled into chunks)
• The only high-severity item, OBFUSCATION-UNICODE_HEAVY-content-scripts/usage-widget.js-1, sits in the widget renderer that draws bar and status glyphs
• content-scripts/usage-capture.js and content-scripts/usage-widget.js perform fetches consistent with reading and displaying quota for the AI pages the user has open

False Positive Considerations

• 40 low-severity code-smell rules matching ordinary JavaScript patterns in bundled files
• Unicode-heavy flag on a widget renderer that draws progress-bar and status glyphs
• socket.io string matches from bundled library code counted as network findings
• Network endpoint list inflated by framework documentation URLs (tailwindcss.com, wxt.dev) shipped inside build chunks

Reviewed 2026-10-11; recommended action: monitor; model confidence 75%.