Is AI Mind Map Maker safe?
We analyzed AI Mind Map Maker version 1.0's actual code and gave it a 93/100 trust score. This appears to be a narrowly scoped website launcher with no…
Bottom line
This appears to be a narrowly scoped website launcher with no demonstrated data access or misuse.
What it can access
The extension requests no browser permissions and has no demonstrated access to pages, private browser data, or device features. [Q1] It opens the advertised mind-map website after installation and through a visible button, which fits a simple launcher. [Q6] [Q8]
Security weaknesses
No meaningful security weakness was found: the package has no page access, exposed privileged features, or remote command handling. [Q2] [Q16] [Q21] Its fixed navigation behavior is simple and inspectable. [Q10]
Signs of misuse
There is no evidence of tracking, sensitive-data collection, deceptive redirection, or other misuse. [Q12] [Q14] [Q17] The only automatic action is opening the advertised site once after installation, which is disclosed by the findings. [Q8]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests no permissions, host access or page access. That is narrower than required for most extensions and appropriate for a simple website launcher.
Declares Manifest V3, an empty permissions array, a popup and a service worker; there are no host permissions or content scripts. — manifest.json:7-14
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no host_permissions, content_scripts or scripting permission. — manifest.json:7-14
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Grants no page-access capability. — manifest.json:7-14
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The permissions array is empty. — manifest.json:7-8
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
The permissions array is empty. — manifest.json:7-8
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension opens https://mindmapmakerai.com/ in a normal tab. It sends no extension-collected data; ordinary browser requests to that advertised site occur because of navigation.
Opens the fixed mindmapmakerai.com URL after installation. — background.js:3-8
Provides a visible link to the same fixed site. — popup.html:47-52
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Contains only an installation listener and fixed tab navigation. — background.js:1-8
Contains static markup and a normal anchor; it loads no scripts. — popup.html:1-56
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It opens the product website once immediately after installation without a separate click. Later navigation requires clicking the clearly labelled popup button.
chrome.runtime.onInstalled creates a tab for the product website. — background.js:3-8
The popup uses an explicit Add Instructions button for later navigation. — popup.html:47-52
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings capabilities. — manifest.json:7-14
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The complete service worker is readable and performs one fixed navigation. — background.js:1-8
Records one 201-byte JavaScript file and two one-byte empty script files. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The only executable file contains no dynamic-code primitive. — background.js:1-8
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares no tabs, history, host access or content scripts. — manifest.json:7-14
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no storage, identifier, analytics or telemetry logic. — background.js:1-8
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Grants no site, cookie or page-access capability. — manifest.json:7-14
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or relevant permissions. — manifest.json:7-14
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Uses a fixed navigation target and performs no fetch or message handling. — background.js:3-8
Uses a static anchor to the same site. — popup.html:47-52
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Contains one visible fixed link to mindmapmakerai.com without referral parameters. — popup.html:47-52
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
The permissions array is empty. — manifest.json:7-8
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
The only destination is the public HTTPS product website. — background.js:1-8
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The complete executable logic is a direct fixed-URL tab creation call. — background.js:1-8
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no content scripts, externally_connectable entry or web_accessible_resources. — manifest.json:1-20
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The sole event handler performs the same fixed action for every installation. — background.js:1-8
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The service worker only creates one tab during installation. — background.js:1-8
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Has no content script, scripting permission or website access. — manifest.json:7-14