Is ChatGPT Prompt Automation Queue safe?
We analyzed ChatGPT Prompt Automation Queue version 1.52's actual code and gave it a 76/100 trust score. This is a purpose-aligned ChatGPT automation…
Bottom line
This is a purpose-aligned ChatGPT automation extension with moderate access and a meaningful safeguard weakness, but no established abuse.
What it can access
It can store queue data and edit or submit visible page content, mainly for ChatGPT automation, but active-tab access broadens its possible reach.[Q1][Q2][Q3][Q24]
Security weaknesses
Its user-started automation uses generic page controls without checking the tab address, so a matching page could receive an unintended submission.[Q21][Q24]
Signs of misuse
No evidence shows tracking, unrelated data collection, remote commands, or stolen sign-in information; submitted prompts go to the selected ChatGPT page.[Q6][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has scripting, storage, and activeTab permissions plus persistent access to chatgpt.com.
Declares scripting, storage, activeTab, and the chatgpt.com host permission. — manifest.json:8-18
Which websites can it run on, and can it read or change what appears on those pages?
It searches the active page for visible editable controls and ChatGPT status elements, then changes the selected input.
Injected functions query visible editors and generation-status controls and write the queued prompt. — background.js:69-142,148-215
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It processes the prompts and variable values that the user enters into its popup and submits them to the selected page.
Collects prompt text and user-supplied variable values, then starts the queue. — popup.js:90-167
Writes each queued message to the page composer and clicks submit. — background.js:17-40,69-142
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It uses Chrome local storage for prompt queues, saved sequences, run state, and review-prompt state; no browser-history or cookie access exists.
Reads and writes only its own local extension data. — popup.js:17-24,45-76,174-237
Requests storage but not cookies, history, bookmarks, or downloads. — manifest.json:8-18
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the device or native-integration permissions. — manifest.json:8-18
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Queued prompts are submitted to the page the user selected, normally ChatGPT; the popup also references a cdnjs stylesheet, but no developer telemetry or unrelated data upload was found.
Writes the user-created prompt into the target page and clicks its submit button. — background.js:69-142
References Font Awesome CSS hosted by cdnjs. — popup.html:1-8
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All automation rules and selectors are packaged locally. — background.js:1-215
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After an explicit user start, it automatically submits the remaining prompts and polls until ChatGPT appears idle.
Starts automation only from the Send Messages click handler. — popup.js:136-167
Processes the queue and polls generation state until completion. — background.js:17-40,148-215
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-setting override or related permission. — manifest.json:4-39
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable source directly identifies its queue and page-editing behavior. — background.js:1-215
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses packaged functions with callback timers and chrome.scripting.executeScript, not dynamically compiled strings. — background.js:1-215
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads only the active tab identifier before starting. — popup.js:136-167
Polls only predefined status selectors and does not extract response content. — background.js:148-215
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores local run counts and review state without transmitting them. — popup.js:17-76
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission. — manifest.json:8-18
Interacts only with visible composer and status elements. — background.js:69-215
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Processes text entered into the extension's own prompt editor. — popup.js:90-167
Declares no clipboard, capture, camera, or microphone permissions. — manifest.json:8-18
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Accepts only local extension messages and contains no remote command channel. — background.js:1-215
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Uses whichever tab is active when the user starts the sequence. — popup.js:136-167
Uses generic textarea/contenteditable and submit-button selectors without validating the tab URL. — background.js:69-142
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:8-18
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no native or system permissions and only chatgpt.com host access. — manifest.json:8-18
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The page-editing and polling functions are packaged as local source. — background.js:1-215
Can ordinary websites access privileged extension features through messaging or exposed files?
The manifest injects popup UI code into chatgpt.com; it normally fails because the expected popup elements are absent, but page-controlled matching elements could activate privileged handlers. This latent bridge was not demonstrated in ordinary use.
Loads popup.js as a content script on chatgpt.com. — manifest.json:27-32
Queries fixed DOM IDs, reads extension storage, attaches DOM event handlers, and can send startSequence messages. — popup.js:1-24,115-170
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Start and stop actions are bound to explicit popup button clicks. — popup.js:136-172
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The only repeated work is bounded prompt sequencing and generation-status polling. — background.js:17-40,148-215
Does it change form fields or where a form sends its information?
A complete user-click-to-form-sink path edits the lowest visible textarea or contenteditable and clicks a generic submit button. It is intended for ChatGPT, but no URL allowlist prevents accidental submission on another active site.
Captures the current active tab and sends its ID with user-created messages. — popup.js:136-167
Injects into that tab, selects generic editable elements, assigns the message, and clicks button[type=submit]. — background.js:69-142
activeTab allows the user-invoked action on the current page even outside the persistent chatgpt.com host permission. — manifest.json:8-18