Is AI Mindmap - ChatGPT Mind Maps Maker safe?
We analyzed AI Mindmap - ChatGPT Mind Maps Maker version 1.0.0's actual code and gave it a 78/100 trust score. This is a limited launcher with moderate…
Bottom line
This is a limited launcher with moderate privacy concerns from unnecessary profile-identity access.
What it can access
It requests profile identity access and sends popup text to its own mind-map site; this broadly fits the feature, but identity access is unnecessary. [Q1][Q3][Q6]
Security weaknesses
The main weakness is unnecessary automatic reading and logging of profile identity during installation. [Q1][Q8]
Signs of misuse
No evidence shows tracking, page-data collection, or misuse of the profile information; the only unexplained action is automatic identity logging. [Q8][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only identity and identity.email. It has no website access, page access, active-tab access, or ability to read visited pages, but the email permission is unnecessary for the launcher behavior shown in the package.
Declares identity and identity.email and no host permissions. — manifest.json:permissions
Calls chrome.identity.getProfileUserInfo on installation. — assets/background.js-mCRtLarN.js:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts, host_permissions, scripting permission, or web-accessible page integration. — manifest.json:top-level fields
Uses chrome.tabs.create only to open the remote mind-map URL. — assets/popup-CDqwZIQG.js:popup setup function
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read the signed-in Chrome profile's email address and Google account ID. It also receives up to 200 characters that the user deliberately types into its popup, but cannot inspect other page or document content.
Reads email and id from chrome.identity.getProfileUserInfo. — assets/background.js-mCRtLarN.js:1
Binds the popup textarea to a local value and uses it when opening the website. — assets/popup-CDqwZIQG.js:popup component
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads Chrome profile identity information on install but does not store it. It has no storage permission and does not read cookies, browsing history, or existing tabs.
Reads and console-logs profile information without a storage call. — assets/background.js-mCRtLarN.js:1
Does not request storage, cookies, history, or tabs. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Only identity and identity.email are present. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
When the user clicks Start Generate, the entered prompt is sent to zestgpt.com as the text query parameter of a newly opened URL. The package contains no other outbound data request.
Opens https://www.zestgpt.com/ai-mindmap?type=extension&text=${enteredText}. — assets/popup-CDqwZIQG.js:C click handler
Its only network-adjacent action is setting a zestgpt.com uninstall URL; it does not transmit the profile values. — assets/background.js-mCRtLarN.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All extension entry points reference packaged files. — manifest.json:background and action
Navigates a new tab to the website rather than loading its scripts into an extension page. — assets/popup-CDqwZIQG.js:C click handler
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On installation it automatically reads and console-logs the Chrome profile email and ID. Prompt transmission happens only after the user types text and clicks Start Generate.
Calls getProfileUserInfo inside runtime.onInstalled without a feature action. — assets/background.js-mCRtLarN.js:1
Opens the website only in direct response to the popup button. — assets/popup-CDqwZIQG.js:button click handler
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings, proxy, search, management, declarativeNetRequest, or webRequest permission. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The complete service worker is a single short statement. — assets/background.js-mCRtLarN.js:1
Contains the complete popup UI and click behavior in one small bundle. — assets/popup-CDqwZIQG.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains no eval call, new Function construction, or string argument to setTimeout/setInterval. — assets/*.js:complete JavaScript review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, webNavigation, webRequest, or host permission is declared. — manifest.json:permissions
Does it create a persistent ID or browser fingerprint to recognize you?
It can obtain the stable Google account ID exposed by Chrome identity, but the package only prints it to the service-worker console. It creates no separate fingerprint or tracking ID and does not transmit the account ID.
Reads profileUserInfo.id and passes the returned object to console.log. — assets/background.js-mCRtLarN.js:1
No fetch, XHR, beacon, or WebSocket carries identity data. — assets/*.js:network sink review
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads the signed-in Chrome profile email and account ID, but does not send them elsewhere in the reviewed code. It cannot read website cookies, passwords, sessions, or page contents.
Declares identity.email but no cookies or site access. — manifest.json:permissions
Reads and console-logs the profile response; no outbound call follows. — assets/background.js-mCRtLarN.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It records only text typed into its own popup textarea, then deliberately sends that text in the zestgpt.com URL when the user clicks the button. It cannot record typing in other pages, read the clipboard, or take screenshots.
Binds user-entered text locally and interpolates it directly into the new-tab URL. — assets/popup-CDqwZIQG.js:textarea model and C click handler
No site, clipboard, desktopCapture, or tabCapture permission is declared. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Hands off the prompt to the remote website in a new tab and performs no further processing. — assets/popup-CDqwZIQG.js:C click handler
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No webpage access or content script exists. — manifest.json:top-level fields
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads, or proxy permission is declared. — manifest.json:permissions
Calls chrome.tabs.create with the mind-map URL. — assets/popup-CDqwZIQG.js:C click handler
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Contains only packaged UI/runtime code and no encoded-payload execution chain. — assets/*.js:complete JavaScript review
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable declaration exists. — manifest.json:top-level fields
Registers only an onInstalled listener. — assets/background.js-mCRtLarN.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches only on Chrome's install/update reason. — assets/background.js-mCRtLarN.js:1
Disables the generate button when the local text value is empty. — assets/popup-CDqwZIQG.js:popup component
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The package contains only a small launcher UI and framework runtime. — assets/*.js:complete JavaScript review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or site access exists. — manifest.json:top-level fields
Handles only the extension popup's own textarea and button. — assets/popup-CDqwZIQG.js:popup component