Is Task Manager safe?
We analyzed Task Manager version 1.0's actual code and gave it a 95/100 trust score. This appears to be a narrowly scoped task manager with no evidence of…
Bottom line
This appears to be a narrowly scoped task manager with no evidence of misuse or meaningful security weakness.
What it can access
It requests only local storage for tasks and language, plus user-triggered file import/export, which fits a task manager. [Q1][Q4][Q5]
Security weaknesses
No remote code, website control, outside messaging, or exposed privileged files was found. [Q7][Q11][Q16][Q21]
Signs of misuse
There is no evidence it sends data elsewhere, tracks browsing, steals session information, or alters websites. [Q6][Q12][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only the storage permission. There are no website access, page access, background worker, tabs access, or other privileged Chrome services.
Declares only storage and a popup action. — manifest.json:permissions and top-level fields
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No content_scripts, host_permissions, activeTab, or scripting entry exists. — manifest.json:top-level fields
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Defines the extension's own task input and Add button. — popup.html:44-57
Reads that popup input only when adding a task. — popup.js:150-159
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores the user's task text, completion flags, task timestamps, and language preference in chrome.storage.local. Data is not synced to an account or sent to a server.
Wraps chrome.storage.local and saves or loads tasks and lang. — popup.js:4-24, 194-210
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
Import can read one JSON file that the user explicitly chooses through a file picker, and export creates a JSON download. It has no broad filesystem, location, camera, microphone, screen, clipboard, native-app, or localhost access.
Creates a user-triggered Blob download and reads a user-selected .json file with FileReader. — popup.js:213-253
Declares no device, clipboard, nativeMessaging, downloads, or file-system permission. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Uses extension storage, DOM APIs, Blob URLs, and FileReader but no fetch, XHR, WebSocket, or beacon. — popup.js:entire file
Contains the packaged Tailwind browser compiler and no network request API call. — test.js:entire file
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads packaged test.js, popup.css, and popup.js by relative paths. — popup.html:9-13, 77
Declares no host permissions or remotely hosted resources. — manifest.json:top-level fields
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Wires mutations to Add, Clear, Import, Export, checkbox, delete, and language UI events; startup calls load(). — popup.js:187-268
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no browser override, proxy, management, or settings permission. — manifest.json:top-level fields
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The first-party task code is short and readable. A 294 KB minified Tailwind browser build makes the package larger, but its header identifies the library/version and its role is limited to generating popup CSS.
Identifies itself as the jsDelivr-minified @tailwindcss/browser 4.1.16 build. — test.js:header and entire file
Loads it as the popup's Tailwind styling runtime. — popup.html:9-10
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Animation timers use arrow-function callbacks. — popup.js:168-184
No eval or new Function sink was found. — test.js:entire file
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, host access, or content script is declared. — manifest.json:top-level fields
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Creates local task IDs with Math.random and uses them only for list operations. — popup.js:68-73, 150-165
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Only storage is requested; cookies and identity are absent. — manifest.json:permissions
Does it record typing, form entries, clipboard contents, or screenshots?
It reads task text typed into its own popup and task data from a JSON file the user chooses. It does not observe keystrokes, selections, clipboard contents, screenshots, camera, or microphone data outside its popup.
Reads the task input when submitted and parses a selected import file. — popup.js:150-159, 227-253
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable entry exists. — manifest.json:top-level fields
Contains no runtime message listener or remote request. — popup.js:entire file
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Popup contains only task controls and language/import/export UI. — popup.html:16-75
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission is declared. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or network host access is declared. — manifest.json:permissions and top-level fields
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses JSON, maps approved task fields, and assigns task.text through textContent. — popup.js:85-143, 227-252
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no web_accessible_resources or externally_connectable declaration. — manifest.json:top-level fields
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Language and stored tasks are the only state-dependent behavior. — popup.js:26-52, 204-210, 256-268
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
No background worker is declared. — manifest.json:top-level fields
Observes and styles the popup DOM; it has no background or network role. — test.js:browser runtime startup
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reads and clears the extension's own task input. — popup.js:150-159
No ability to inject into websites is declared. — manifest.json:top-level fields