Is RSS Feed URL Finder safe?
We analyzed RSS Feed URL Finder version 1.0.3's actual code and gave it a 65/100 trust score. This is a purpose-aligned feed finder with broad automatic…
Bottom line
This is a purpose-aligned feed finder with broad automatic page-reading access and limited demonstrated abuse.
What it can access
It requests access across HTTPS websites and reads full rendered page content to find feeds. [Q1] [Q2] Scanning happens automatically during navigation, and exact feed-bearing page URLs are stored locally. [Q8] [Q12]
Security weaknesses
Reading complete page content can expose sensitive information displayed on websites. [Q3] Automatic scanning has no per-page request or site allowlist, and user-selected HTTPS addresses may reach local services, although compromise was not demonstrated. [Q8] [Q19]
Signs of misuse
There is no evidence that it executes downloaded code, sends page contents or authentication information elsewhere, accepts remote commands, or changes links and search behavior. [Q7] [Q14] [Q16] [Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The permissions are functional but broader than necessary. scripting and HTTPS-wide host access let it read every active HTTPS page, while webNavigation triggers scans without a popup click.
Requests scripting, storage, webNavigation and https://*/* host access. — manifest.json:3
Navigation and tab listeners repeatedly call executeScript in the active tab; the injected function returns the entire documentElement.innerHTML. — background.5fadff2f.js:20
Which websites can it run on, and can it read or change what appears on those pages?
It can read the full rendered page of every active HTTPS page. The active path serializes document.documentElement.innerHTML and returns it to the background worker for RSS-link parsing.
Mt returns document.documentElement.innerHTML; ye injects Mt into the active tab and passes the result to Bt. — background.5fadff2f.js:20
The https://*/* host permission makes the injection available across HTTPS websites. — manifest.json:3
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Sensitive text or values already represented in the page can enter the returned full-page HTML. Live password-field values are normally not serialized as value attributes, but pages may render account, message or form data elsewhere.
Serializes the complete active-page HTML instead of selecting only feed-link elements. — background.5fadff2f.js:20
Bt parses the returned string locally and extracts link href attributes; it contains no network call. — background.5fadff2f.js:20
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It does not request cookies, history, bookmarks or downloads services. However, exact active-page URLs enter the background and are saved in chrome.storage.local when feeds are found, leaving a limited local record of previously visited feed-bearing pages.
No cookies, history, bookmarks or downloads permission is declared. — manifest.json:3
Bt stores the feed array under both the exact page URL and tab ID; later navigation removes the new URL key and tab key, not the prior page's URL key. — background.5fadff2f.js:20
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write a discovered feed URL to the clipboard only when the user clicks the visible copy button in the popup. It has no filesystem, location, camera, microphone, application-list or native-messaging access.
The CopyUrl button calls navigator.clipboard.writeText with the displayed feed URL from its click handler. — popup.5eb990aa.js:325
No device, file, geolocation, media or nativeMessaging permission is present. — manifest.json:3
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Viewing a feed sends a GET request to that feed's own URL so it can parse and display the feed. Manually submitting a preview URL does the same.
The explicit preview search fetches the submitted URL and parses the returned RSS or HTML. — popup.5eb990aa.js:298
FeedPreview calls rss-parser parseURL for the chosen feed, and visible rss.app links embed the active page URL and require a click. — popup.5eb990aa.js:325
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Fetch response text is checked as RSS or parsed for link elements; it is not executed. — popup.5eb990aa.js:298
rss-parser parses a selected feed into display data. — popup.5eb990aa.js:325
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Whole-page scanning occurs automatically when the active tab or its navigation changes, including while the popup is closed. This supports an always-ready badge count, but there is no per-page user request, site allowlist, opt-out or on-demand-only safeguard.
Registers tabs.onActivated, tabs.onUpdated, webNavigation.onCompleted, onHistoryStateUpdated, tabs.onCreated and onReplaced listeners that call ye. — background.5fadff2f.js:20
ye injects the full-HTML collector immediately and updates the action badge with the feed count. — background.5fadff2f.js:20
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browserSettings, proxy, chromeSettingsOverrides or management permission is declared. — manifest.json:3
Calls chrome.action.setBadgeText with the number of discovered feeds. — background.5fadff2f.js:20
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Both scripts are large minified Plasmo bundles containing React, MUI, Cheerio and rss-parser dependencies. The application-specific behavior remains traceable, and no deliberate encrypted data, hidden analytics client or unexplained executable blob was found.
Lists a 412 KB background bundle and 1.47 MB popup bundle in a 1.9 MB unpacked extension. — inventory.json:1-54
Contains recognizable packaged framework/parser modules plus the feed-finder UI in generated minified form. — popup.5eb990aa.js:1-325
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Third-party setImmediate polyfill converts a non-function callback with new Function(String(callback)). — popup.5eb990aa.js:233
Remote response text is passed to HTML/RSS parsers and UI state, not to the setImmediate callback interface. — popup.5eb990aa.js:298,325
Does it track the websites, pages, searches, or links you visit?
It observes active-tab navigation across HTTPS sites and stores the exact URL of pages where feeds are found. This is active local browsing metadata collection used for retrieval in the popup, not demonstrated remote tracking; no identifier or outbound telemetry path is connected to it.
Navigation listeners repeatedly query the active tab and pass its URL to Bt. — background.5fadff2f.js:20
Bt persists discovered feed arrays under the exact page URL in chrome.storage.local. — background.5fadff2f.js:20
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores feed arrays under page URL and tab-ID keys without creating a user/device identifier. — background.5fadff2f.js:20
Popup logic reads those keys and contains no analytics initialization or fingerprint generation. — popup.5eb990aa.js:298-325
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
executeScript returns page HTML to Bt, which extracts RSS/Atom link hrefs and writes only the resulting URL array. — background.5fadff2f.js:20
No cookies permission is declared. — manifest.json:3
Does it record typing, form entries, clipboard contents, or screenshots?
Because it serializes the page page, it can receive typed values only when a site reflects them into HTML attributes or other rendered markup; normal live input properties are not automatically included by innerHTML. It does not install keyboard/input listeners, capture screenshots or read the clipboard.
The collector reads documentElement.innerHTML and does not attach keydown, input or form-submit listeners. — background.5fadff2f.js:20
The only editable field is the extension popup's visible feed-URL input. — popup.5eb990aa.js:325
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Page-controlled href values are normalized as URLs and stored; there is no message or command dispatcher. — background.5fadff2f.js:20
No externally_connectable or web_accessible_resources bridge is declared. — manifest.json:3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Renders visible Generator and RSS Builder anchors pointing to rss.app with the active page URL. — popup.5eb990aa.js:325
Injected code only returns HTML and makes no page DOM changes. — background.5fadff2f.js:20
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no traffic-control or download permission. — manifest.json:3
Network use is limited to normal feed/page GET requests for explicit preview operations. — popup.5eb990aa.js:298,325
Can it communicate with software on the computer or services running on localhost?
A page can advertise an arbitrary HTTPS feed URL, including an HTTPS service on a local or private hostname, and the popup can fetch it with extension host access after the user clicks View. The request uses no browser credentials by default, and no native-messaging path exists, so meaningful local-service compromise was not demonstrated.
https://*/* permits cross-origin HTTPS feed requests, including hostnames not related to the current site. — manifest.json:3
The user-triggered View action passes the page-supplied feed URL to rss-parser parseURL. — popup.5eb990aa.js:325
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote documents are parsed as HTML/RSS data and displayed through React properties/children. — popup.5eb990aa.js:298,325
Package contains only fixed scripts, HTML, icons and Web Store verification metadata. — inventory.json:1-54
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares neither externally_connectable nor web_accessible_resources. — manifest.json:3
Contains navigation listeners and local parsing, not chrome.runtime.onMessage/onMessageExternal handlers. — background.5fadff2f.js:20
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Listeners invoke one unconditional active-tab scan path; the only special case is a Google News storage-cache shortcut. — background.5fadff2f.js:20
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The recurring work is HTML collection and RSS-link parsing after tab/navigation events. — background.5fadff2f.js:20
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Mt only returns document.documentElement.innerHTML and contains no mutation or event registration. — background.5fadff2f.js:20
Feed URL input and buttons are rendered inside popup.html, not injected into websites. — popup.5eb990aa.js:325