Is Tool For YouTube Live Streams Enhancer safe?
We analyzed Tool For YouTube Live Streams Enhancer version 1.28's actual code and gave it a 84/100 trust score. This appears to be a purpose-aligned…
Bottom line
This appears to be a purpose-aligned YouTube enhancement with limited access, low abuse evidence, and one minor page-message weakness.
What it can access
It can read YouTube player status and change playback controls on YouTube only, fitting its live-stream enhancer purpose; it stores five preferences with browser sync. [Q1][Q2][Q6]
Security weaknesses
A YouTube page can forge player-status messages and influence playback or display text, but cannot gain extra browser powers. [Q16]
Signs of misuse
There is no evidence of data misuse, tracking, remote code, or hidden behavior; synced data is limited to playback preferences. [Q6][Q7][Q14][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and scripting access limited to YouTube. That lets it inspect YouTube's live-player state, change video playback speed, and add controls, which matches its advertised purpose.
Declares storage and scripting, with both scripts and host access limited to *.youtube.com. — manifest.json:6-31
Reads current YouTube live-player identity, live/DVR flags, and timeline position. — inject.js:22-57
Uses that state to render controls and set the current video element's playbackRate. — content.js:210-271
Which websites can it run on, and can it read or change what appears on those pages?
It runs only on YouTube subdomains. There it reads player metadata and timing, inserts its own speed controls, changes the live badge text while active, and adjusts the current video's playback rate; it does not access other sites.
Registers both packaged scripts exclusively for *://*.youtube.com/*. — manifest.json:10-31
Builds and mounts the extension-owned playback toolbar. — content.js:119-185
Sets playbackRate and temporarily replaces the live badge text. — content.js:244-270
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Copies only boolean/string/numeric player fields (isLive, latency, playback time). — inject.js:5-14
Probes and validates only player state; no input or form event listeners. — content.js:59-81
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Queries active tabs and windows, retaining only visible YouTube tab IDs in an in-memory map. — background.js:67-85
Declares storage and scripting but none of the cookies, history, bookmarks, or downloads permissions. — manifest.json:6-31
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Its five playback preferences are stored with chrome.storage.sync, so Chrome may synchronize those non-sensitive settings through the user's browser account. The extension itself makes no fetch, XHR, WebSocket, beacon, or analytics request, and sends no page or player data to its developer.
Reads and writes speed, threshold, and two boolean preferences in chrome.storage.sync. — options.js:15-20,37-59
Consumes the same synchronized settings and reacts to sync changes. — content.js:83-100,306
The only developer-owned remote destination is a donation link that requires a user click and carries no appended data. — options.html:136-138
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Names fixed packaged content scripts and a packaged service worker. — manifest.json:10-26
Restricts extension pages to default-src 'self'. — manifest.json:28-28
Repair logic reinjects only the packaged inject.js and content.js files. — background.js:20-31
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
When a visible YouTube live stream is active, it automatically polls player state, injects its controls, and adjusts playback speed according to local settings. This is the advertised feature; it does not automatically open remote pages, download files, or send application network requests.
Runs a 100 ms scheduler only while a tracked YouTube tab is visible and slows individual content ticks to 100 or 200 ms. — background.js:8-18,33-65
Automatically calculates and applies a bounded 1x-3x playback speed for confirmed live streams. — content.js:210-271
Stops tracking tabs that are not active YouTube tabs in visible windows. — background.js:67-85
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The complete worker logic is readable in one small source file. — background.js:1-122
The full controller and DOM changes are readable and extensively commented. — content.js:1-308
The MAIN-world player bridge is readable and narrowly scoped. — inject.js:1-61
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
setInterval receives the fixed drive function rather than a string. — background.js:8-11
Script injection references fixed packaged filenames. — background.js:20-25
Contains no dynamic code-generation primitive. — content.js:1-308
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses the current watch-page video ID only to correlate a live player-state response. — content.js:28-30,59-81
Keeps only active YouTube tab state in an in-memory Map. — background.js:67-85
Persistent storage is limited to five playback configuration fields. — options.js:15-20
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The complete synchronized settings schema consists of speed, two thresholds, and two feature booleans. — options.js:15-20,48-58
Reads only those same default settings. — content.js:306
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Reads a narrow set of player live-state and timeline values and posts them only within the same YouTube page. — inject.js:22-57
Syncs only playback configuration values. — options.js:15-20,48-58
Requests no cookie or request-inspection permission. — manifest.json:6-31
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Sole DOM write target is video.playbackRate and extension-created status UI; no input or clipboard interaction. — content.js:244-271
Reads only player metadata (videoId, isLive, currentTime, seekable end); no user-input capture. — inject.js:16-57
Can a website or remote server send commands that make the extension take actions?
JavaScript already running in a YouTube page can send forged player-state replies through the same-page postMessage bridge. A correctly numbered reply can influence whether the isolated controller changes that page's video speed or UI, but it cannot invoke downloads, storage writes, network requests, or other browser privileges.
Uses a same-origin window message request/reply channel in the page's MAIN world. — inject.js:16-18,50-57
Accepts same-window, same-origin EYTL_STATE replies with bounded request IDs and matching current video identity. — content.js:59-81
The downstream actions are limited to the current video's playbackRate and extension-owned page UI. — content.js:210-271
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Writes video.playbackRate and updates its own status/badge text; no anchor, ad, or form element is touched. — content.js:244-271
Creates only extension-owned toolbar and switch elements; no modification of existing page links or ads. — content.js:119-186
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads, or proxy permission. — manifest.json:6-31
Writes only the selected YouTube video element's playbackRate in the control path. — content.js:244-256
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Uses only chrome.tabs, chrome.windows, chrome.scripting, and chrome.action APIs; no external process or localhost endpoint. — background.js:6-85
Bridge communication is limited to window.postMessage within the YouTube tab. — content.js:59-81
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Entire service worker is straightforward event handling and tab messaging; no decode/execute patterns. — background.js:1-121
All logic is explicit DOM manipulation and player-state checks; no hidden data unpacking. — content.js:1-307
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Limits scripts and host access to YouTube and declares no externally_connectable or web-accessible resource. — manifest.json:10-31
Bridge input reaches only same-page live-state, toolbar, badge, and playback-rate logic. — content.js:59-81,210-271
The privileged worker accepts its visibility message only from a top-frame YouTube sender. — background.js:87-105
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines the local settings and deterministic rate calculation. — content.js:8-18,83-118
Schedules work from visibility and active-tab state only. — background.js:33-85
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runs the single scheduler only while at least one tracked YouTube tab is visible and stops it when idle. — background.js:8-18,33-85
Each tick checks player state, computes a bounded rate, and updates small DOM elements. — content.js:210-280
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates only the extension's toolbar, buttons, status text, and switch. — content.js:119-208
Changes playbackRate and live-badge text, not form elements. — content.js:244-270