Streaming Skipper – Skip Ads, Intros & Recaps [QVI]

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This ad-skipping extension for Paramount Plus generates 135 findings, but none indicate actual malicious behavior. The 107 IoC findings are all documented false positives from the XIOC extractor. Specifically, XIOC-DOMAIN-this.country and XIOC-DOMAIN-this.observer in the evidence are JavaScript property access chains misread as domains—this matches the documented FP pattern where b.call, h.next, g.id chains trigger false domain detection. Similarly, XIOC-DOMAIN-deps.map, XIOC-DOMAIN-currentdeps.map, and XIOC-DOMAIN-commands.map are source map file references, not network destinations. The XIOC-URL-http://purl.org/dc/elements/1.1/ finding is a legitimate Dublin Core metadata namespace URL commonly embedded in web code.

The 9 network findings show generic fetch calls at paramount.min.js:4226, paramount.min.js:4192, paramount.min.js:4782, and typ.min.js:173. These are expected behavior for an extension that interacts with video player APIs to skip content. None reference suspicious domains—no custom search engines, no data exfiltration endpoints, no credential harvesting URLs. The 19 code-smell findings are classified as low severity and per CVEQ documentation, code-smell rules like postinstall_* and credential_* fire on almost any non-trivial JavaScript and should never drive a verdict.

Critically, there are zero malware signatures, zero obfuscation findings, and no high-severity indicators. The extension description explicitly states it is "Independent software not affiliated with Paramount" and describes legitimate ad-skipping functionality. The anonymous developer email ([email protected]) is common for utility extensions and not inherently suspicious.

The strongest counterargument is that an anonymous publisher with network activity could indicate malicious data collection. However, this argument fails because: (1) the network findings show no suspicious destination domains, only generic fetch calls; (2) there is no credential access or cookie manipulation evidence; (3) the extension's stated purpose (ad-skipping) aligns with its code behavior; and (4) all high-volume findings match documented XIOC false positive patterns. A skeptic would need to point to specific malicious domains or malware signatures, which are absent from this evidence bundle.

Key Reasons

• All 107 IoC findings are XIOC false positives (property access chains, source map references)
• Zero malware signatures detected
• Zero obfuscation findings
• Network findings are generic fetch calls without suspicious destinations
• Extension behavior matches described ad-skipping purpose

False Positive Considerations

• XIOC property access chain misidentification (this.country, this.observer)
• Source map file references flagged as domains (deps.map, currentdeps.map)
• Dublin Core namespace URL (purl.org)
• Code-smell findings (documented noise)

Reviewed 2026-04-29; recommended action: suppress false positive; model confidence 85%.