Is Task Manager Lite safe?
We analyzed Task Manager Lite version 1.0's actual code and gave it a 94/100 trust score. Task Manager Lite is a narrowly scoped task list with no…
Bottom line
Task Manager Lite is a narrowly scoped task list with no evidence of misuse or dangerous capabilities.
What it can access
It requests only local storage for task data and preferences, matching its task-list purpose; it also loads Google Fonts.[Q1][Q3][Q4][Q6]
Security weaknesses
No meaningful security weakness was found: it has no remote code, website messaging, or privileged browser controls.[Q7][Q10][Q11][Q16]
Signs of misuse
No evidence shows tracking, session-data sharing, or deceptive changes; the only outside request is a Google Fonts stylesheet.[Q6][Q12][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Declares only storage and a popup. — manifest.json:3-23
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, scripting permission, or host access. — manifest.json:3-23
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads task text typed into its own popup. That text never reaches an ordinary webpage or network request.
Defines the extension-owned task input and lists. — popup.html:13-20
Reads the submitted task and renders it with textContent. — popup.js:13-27
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores task text, completion state, and dark-mode preference in the popup origin's localStorage. It does not access cookies, history, bookmarks, or saved passwords.
Reads and writes only tasks and darkMode in localStorage. — popup.js:66-119
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of those permissions. — manifest.json:3-23
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The popup loads a fixed stylesheet from Google Fonts. This exposes normal request metadata to Google but does not send task contents.
Imports the Poppins stylesheet from fonts.googleapis.com. — style.css:1
Contains no network request or code that adds task data to the font URL. — popup.js:1-120
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All behavior and settings are defined locally. — popup.js:1-120
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Declares a popup and no background worker. — manifest.json:3-23
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no override or browser-settings permissions. — manifest.json:3-23
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains straightforward task-list and theme logic. — popup.js:1-120
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains no text-to-code execution sink. — popup.js:1-120
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no tabs, activeTab, or history permission. — manifest.json:3-23
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Uses only DOM and localStorage APIs for the task list. — popup.js:1-120
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or identity permissions. — manifest.json:3-23
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads the task field only when the popup form is submitted. — popup.js:13-20
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no messaging or remote-response handler. — popup.js:1-120
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Hosts the task-list UI entirely inside the extension popup. — popup.html:8-22
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no network-control or downloads permission. — manifest.json:3-23
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:3-23
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The only remote resource reference is a Google Fonts CSS import. — style.css:1
Loads JavaScript only from the packaged popup.js file. — popup.html:22
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Registers only local DOM event listeners. — popup.js:1-120
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Reads and writes the local darkMode preference. — popup.js:108-119
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains only small event-driven task-list operations. — popup.js:1-120
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines the extension's own task form. — popup.html:13-16
Handles only that form's submit event. — popup.js:13-20