Is Keywords From Urls Blogging Tools Extension safe?
We analyzed Keywords From Urls Blogging Tools Extension version 1.0's actual code and gave it a 78/100 trust score. This appears to be a local SEO utility…
Bottom line
This appears to be a local SEO utility with unnecessary broad website access and a modest unsafe output-handling concern.
What it can access
It can access every website, although the reviewed tools run only in the popup; it also writes generated text to the clipboard after clicks. [Q1][Q5]
Security weaknesses
The broad website permission is unnecessary, and user-provided text is inserted into displayed markup, creating avoidable safety risk. [Q1][Q17]
Signs of misuse
No evidence shows information leaving the browser, remote commands, automatic actions, or hidden data collection. [Q6][Q8][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests host access to every website, which its popup-only text tools do not need. No packaged code uses that access.
Declares clipboardWrite and <all_urls>, with only a popup entry point. — manifest.json:8-12
Contains no content injection, tab access or cross-origin request. — script.js:1-303
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts and requests no scripting or tabs permission. — manifest.json:8-12
The packaged popup is the only user interface and loads script.js locally. — popup.html:9-22
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads only user-entered URL, keyword, article-text and slug fields in the popup. — script.js:17-20,64-69,103-107,160-170,204-222
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests only clipboardWrite plus host access. — manifest.json:8-9
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
Visible Copy buttons write generated results to the clipboard after the user clicks them. No clipboard reads or device capture occur.
Calls navigator.clipboard.writeText only in Copy button handlers. — script.js:28-31,73-89,178-181
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
All processing is synchronous local JavaScript with no fetch, XHR, WebSocket, beacon or external navigation. — script.js:1-303
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All four tools and their behavior are defined in the packaged script. — script.js:5-186
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Sensitive or consequential actions are attached to popup buttons; startup selects the default tool only. — script.js:17-33,71-89,110-138,160-181,289-302
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings, proxy, privacy or management permission. — manifest.json:8-19
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Plain, named JavaScript implements each tool directly. — script.js:1-303
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Each setTimeout receives a local function that resets button text. — script.js:31,78-80,181,283-285
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Passes pasted strings to the standard URL parser and extracts the final path segment or hostname. — script.js:17-20,188-201
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Uses no storage, analytics library or identifier-generation code. — script.js:1-303
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission. — manifest.json:8-9
Contains no cookie, session or authentication API. — script.js:1-303
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Calls clipboard.writeText, not clipboard.read, from explicit handlers. — script.js:28-31,73-89,178-181
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no network client, remote parser or extension message listener. — script.js:1-303
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Grouping output concatenates raw words into HTML strings and assigns them to outputArea, commonTopics and uniqueTopics innerHTML. — script.js:204-279
Extension-page CSP allows scripts only from self and blocks objects. — manifest.json:17-19
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads or proxy permission. — manifest.json:8-9
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:8-9
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads the packaged script.js file. — popup.html:22
Restricts extension-page scripts to self. — manifest.json:17-19
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts or externally_connectable declaration. — manifest.json:1-20
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Switches local popup views without reading or writing persistent storage. — script.js:289-302
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Computation is limited to user-triggered word counting, sorting and text transformation in the popup. — script.js:110-138,204-285
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Raw user-controlled words are concatenated into outputHTML, commonHTML and uniqueHTML before innerHTML assignment. — script.js:204-279
The affected script runs only in the extension popup; no content script is declared. — manifest.json:10-12