Is Conso: AI Usage Tracker safe?
We analyzed Conso: AI Usage Tracker version 0.1.4's actual code and gave it a 62/100 trust score. Conso is purpose-aligned but has substantial privacy…
Bottom line
Conso is purpose-aligned but has substantial privacy exposure because it can collect and send the contents of supported AI conversations.
What it can access
The extension has access to Conso and, after approval, listed AI websites, where it can read conversation content for its usage-tracking feature. [Q2] Because prompts and responses may contain sensitive information, this is meaningful privacy access even though it is limited to supported AI sites. [
Signs of misuse
The extension sends prompts, responses, attachment details, and usage information to Conso when it detects supported AI conversations. [Q6] This is consistent with its stated tracking purpose, but collecting full conversation content is more intrusive than usage statistics alone; no confirmed remote
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests access to its own service and, after approval, supported AI websites so it can read conversations and calculate usage. This fits its stated tracking purpose, but reading and sending complete prompts and responses creates meaningful privacy exposure.
The manifest requests storage, identity, and scripting access; it directly covers conso.xyz and optionally covers ChatGPT, Claude, Gemini, and Perplexity sites. — manifest.json:1
On supported AI sites, the extension reads prompt text, attachment metadata, and generated responses from matching conversations. — content-scripts/chatgpt-injector.js:1-4
The bridge processes the conversation data for usage calculations and recording. — content-scripts/chatgpt-bridge.js:3311-3311
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://conso.xyz/*, https://www.conso.xyz/*, https://chatgpt.com/*, https://chat.openai.com/*, https://claude.ai/*, https://gemini.google.com/*, https://www.perplexity.ai/*, https://perplexity.ai/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
On supported AI sites, the extension reads prompts, uploaded-file metadata, and generated responses while those sites process a conversation. Therefore, anything you submit in an AI prompt—including sensitive text—is accessible to the extension; it does not establish general form or keystroke monitoring on unrelated sites.
A MAIN-world fetch wrapper recognizes conversation requests, parses user message text, image and non-image attachment metadata, and accumulates assistant response text before posting a turn record. — content-scripts/chatgpt-injector.js:1-4
The bridge consumes the posted turn payload and uses prompt and response fields for usage calculations. — content-scripts/chatgpt-bridge.js:3311-3311
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No code evidence was found that reads browser cookies, history, bookmarks, downloads, or signed-in sessions from other sites. The extension does use its own storage and identity-related authentication.
Permissions are storage, identity, and scripting; it does not request cookies, history, bookmarks, or downloads. — manifest.json:3
Bundled authentication/storage code is present, but the inspected behavior concerns the extension’s own Conso authentication rather than browser website-session extraction. — background.js:1-11
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Detected AI usage records are sent through the bridge's recording logic to CONSO's backend, including prompt and response-derived usage data and identifiers. This occurs for matching conversations on supported AI sites, not for every page visited.
The injector creates a CONSO_DETECTED_TURN payload containing platform, model, conversation ID, prompt text, response text, attachment information, and a request key. — content-scripts/chatgpt-injector.js:1-4
After receiving a validated turn message, the bridge calculates token and usage statistics and calls the recording function appendPrompt. — content-scripts/chatgpt-bridge.js:3311-3311
The manifest declares conso.xyz as the extension's host-permission backend origin. — manifest.json:1-1
Does it download or run code, settings, or instructions supplied by a remote server?
The reviewed runtime paths show ordinary network and authentication code, but the bundled service worker and popup are very large and difficult to audit exhaustively. No established path was found that downloads JavaScript and executes it, yet complete remote configuration or instruction handling cannot be ruled out from these bundles alone.
The service worker is a large bundled single-line build containing networking and authentication code; the available line structure does not make all remote-response consumers readily auditable. — background.js:1-11
The popup is also a large generated bundle with substantial library code and remote-service interactions. — chunks/popup-8bxjErWk.js:1-74
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It can open Conso pages from the popup, perform authentication/network requests, and automatically observe matching AI requests while you use those sites. The inspected code does not show search redirection or arbitrary downloads.
Creates a tab for https://conso.xyz/zaps from a popup action. — chunks/popup-8bxjErWk.js:74
Automatically hooks fetch at document_start and processes matching completion requests. — content-scripts/chatgpt-injector.js:1-3
Automatically hooks completion and upload requests at document_start. — content-scripts/claude-injector.js:1-5
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because core runtime files are generated, minified, and in some cases multi-megabyte single-line bundles. This reduces auditability, although minification alone does not prove malicious behavior.
The service-worker bundle concentrates extensive runtime logic into very few long lines. — background.js:1-11
The popup bundle is a large generated/minified file. — chunks/popup-8bxjErWk.js:1-74
The bridge contains a multi-megabyte generated bundle with substantial embedded library code. — content-scripts/chatgpt-bridge.js:1-11
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct use of eval(), new Function(), or string-based timers was found in the inspected source search. The code does use ordinary timers and dynamic library code, but that is not the same as these execution mechanisms.
No direct eval or new Function call was identified in the inspected service-worker bundle. — background.js:1-11
The injector uses ordinary functions and fetch interception; no direct string-to-code execution was identified. — content-scripts/chatgpt-injector.js:1-3
Does it track the websites, pages, searches, or links you visit?
The extension records AI conversations and derived usage statistics on supported AI sites, but the reviewed code does not establish general tracking of websites, pages, searches, or links you visit. Its observed tracking is limited to matching AI conversation requests.
The injector only matches specific AI conversation API paths and emits turn data for those requests. — content-scripts/chatgpt-injector.js:1-4
The bridge processes detected turns for token and usage calculations rather than recording arbitrary navigation history. — content-scripts/chatgpt-bridge.js:3311-3311
The manifest lists optional access only for the supported AI origins, not broad site access. — manifest.json:1-1
Does it create a persistent ID or browser fingerprint to recognize you?
The code uses the service’s authenticated account/session identity, but I found no evidence of a browser fingerprint or separate tracking ID.
The extension declares identity and storage permissions, but no fingerprinting-specific permission. — manifest.json:1-1
Bundled authentication code stores and refreshes an application session; this is not evidence of browser fingerprinting. — background.js:8-11
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends page-derived AI conversation contents and identifiers to CONSO, but the reviewed path does not show it exporting cookies or session tokens. This is still page-content disclosure because prompts and generated responses can contain sensitive authentication or personal information entered into the AI conversation.
The injector places prompt text, response text, conversation identifiers, model data, and attachment information into the detected-turn payload. — content-scripts/chatgpt-injector.js:1-4
The bridge consumes the payload and records derived prompt/response usage through appendPrompt. — content-scripts/chatgpt-bridge.js:3311-3311
Does it record typing, form entries, clipboard contents, or screenshots?
The extension reads submitted AI prompt contents and generated responses, but the reviewed code does not establish a general keystroke logger or screenshot capture. A popup clipboard read, if used, is a user-facing referral workflow rather than evidence that all clipboard contents are continuously collected.
The injector reads request bodies and streamed responses for supported AI conversations. — content-scripts/chatgpt-injector.js:1-4
The popup bundle contains a navigator.clipboard.readText call associated with popup functionality. — chunks/popup-8bxjErWk.js:19-19
Can a website or remote server send commands that make the extension take actions?
The page can report detected AI turns to the extension bridge, but the verified message path is one-way reporting and does not expose an arbitrary command interface. No source-to-sink path was established in which a website or remote server makes the extension perform an unrelated privileged action.
The listener accepts only same-window messages whose source and type are conso-extension and CONSO_DETECTED_TURN, then performs usage accounting and recording. — content-scripts/chatgpt-bridge.js:3311-3311
The injector posts detected usage records; it does not show a command dispatcher or privileged action request. — content-scripts/chatgpt-injector.js:1-4
The manifest lacks broad tabs, webRequest, proxy, or downloads permissions that would independently establish broad privileged action capability. — manifest.json:1-1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
I found no implemented link, referral-code, advertisement, shopping-cart, or search-result rewriting. Referral handling appears to verify or copy a user-provided link rather than alter browsing traffic.
The referral workflow reads and validates a pasted tweet link and may copy a referral code. — chunks/popup-8bxjErWk.js:19-19
No webRequest, declarativeNetRequest, or broad navigation permission is declared. — manifest.json:1-1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
There is no evidence that the extension redirects pages, changes request headers, controls downloads, or changes proxy settings.
The manifest declares storage, identity, and scripting, but not proxy, webRequest, webRequestBlocking, or downloads. — manifest.json:1-1
The injector wraps page fetch/XMLHttpRequest to observe AI completion traffic and report usage; it does not show redirect or header-modification logic. — content-scripts/chatgpt-injector.js:1-2
Can it communicate with software on the computer or services running on localhost?
The bundled authentication library contains localhost fallback constants, but I found no evidence that the extension actually communicates with local computer software or a localhost service.
The localhost:9999 value occurs in bundled Supabase authentication support code. — background.js:7-11
No nativeMessaging permission is declared, and localhost is not an extension host permission. — manifest.json:1-1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
I found no evidence of hidden payload unpacking followed by execution or injection. The bundled base64 operations are part of authentication/network encoding, not demonstrated dynamic code execution.
The visible atob/btoa use occurs in authentication/WebSocket encoding code. — background.js:1-1
No externally supplied script or executable resource is declared. — manifest.json:1-1
Can ordinary websites access privileged extension features through messaging or exposed files?
A supported AI page can communicate with the extension through a window-message bridge, but the exposed operation is narrowly limited to reporting detected AI usage. The reviewed path does not show ordinary websites gaining extension APIs or privileged control through web-accessible files.
The bridge listens for same-window messages and accepts only the conso-extension source label and CONSO_DETECTED_TURN type before recording usage. — content-scripts/chatgpt-bridge.js:3311-3311
The page-main-world injector posts prompt, response, model, conversation, and attachment-derived usage records to that bridge. — content-scripts/chatgpt-injector.js:1-4
The optional host origins are limited to the listed AI services; no web-accessible extension file or broad page messaging permission is declared. — manifest.json:1-1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Activation is conditional: the content scripts run only on the supported AI sites and process records only for particular completion requests and a signed-in CONSO user.
Optional host permissions list the supported AI platforms. — manifest.json:1-1
The injector matches Gemini completion requests before extracting data. — content-scripts/gemini-injector.js:1-2
Processing requires a recognized CONSO message and checks for a current CONSO user. — content-scripts/chatgpt-bridge.js:3311-3311
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
I found no cryptocurrency-mining code or other concealed intensive computation. The worker code shown is a short heartbeat mechanism for a network connection.
The worker periodically posts keepAlive messages and sends a heartbeat. — background.js:5-7
No unusual compute, filesystem, or native-software permissions are declared. — manifest.json:1-1
Does it change form fields or where a form sends its information?
I found no evidence that it changes ordinary website form fields or form destinations. The visible popup input is an extension UI field for a pasted referral link, not a webpage form alteration.
The input shown is rendered in the extension popup and accepts a tweet link. — chunks/popup-8bxjErWk.js:20-20
No broad form or traffic-modification permission is declared. — manifest.json:1-1