Is WProofreader: AI grammar check & rewrite tool safe?
We analyzed WProofreader: AI grammar check & rewrite tool version 2.5.17's actual code and gave it a 78/100 trust score. This is a legitimate proofreading…
Bottom line
This is a legitimate proofreading extension with broad page access and moderate privacy exposure, but no established abuse.
What it can access
It can run across websites, inspect eligible writing areas, read its own login-state cookie, and send writing to its service for proofreading.[Q1][Q3][Q4][Q6]
Security weaknesses
Broad page access and remote settings increase exposure, while minified code makes independent review harder; no remote code execution was established.[Q1][Q7][Q10][Q16]
Signs of misuse
The package sends writing for advertised features, but shows no unrelated tracking, arbitrary cookie sharing, or indiscriminate keystroke collection.[Q6][Q12][Q14][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can run in every frame on all HTTP and HTTPS pages, read and alter supported editors, inspect tab URLs, store settings, read a service cookie, and inject packaged scripts. This is broad access, but most of it directly supports site-wide proofreading.
Declares all-site host access, an all-frames content script, tabs, storage, unlimitedStorage, cookies, scripting, and activeTab. — manifest.json:4-44
Initializes proofing in eligible page editors and coordinates state with the background worker. — content/content.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It inspects editable page content, monitors changes and focus, and adds spelling, grammar, autocomplete, and rewrite interfaces. It does not generally read non-editable page text.
Loads the content script in every frame and adds a Google Docs-specific integration. — manifest.json:26-44
Finds focused textareas/contenteditable elements, observes edits, marks problems, and presents writing controls. — wscbundle/wscbundle.js:44-61
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can process sensitive drafts in textareas, rich-text editors, and Google Docs, including messages or documents. Automatic checking explicitly excludes ordinary input elements, which protects password, card, email, and similar input fields.
Sets disableAutoSearchIn to include input while leaving textareas and rich editors eligible. — content/content.js:1
Selects eligible text-based/contenteditable controls and skips disabled, read-only, hidden, filtered, and unsupported elements. — wscbundle/wscbundle.js:61
Adds a dedicated Google Docs editor integration. — googledocs/googledocs.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads current tab URLs to decide whether checking is enabled and reads the WProofreader login-state cookie. It does not request or use browsing history, bookmarks, downloads, or other-extension management.
Requests tabs and cookies but not history, bookmarks, downloads, browsingData, or management. — manifest.json:4-15
Uses tab URL/host data for enablement rules and reads one named login cookie from the configured WProofreader origin. — background/background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the file, download, capture, geolocation, media, or clipboard-read permissions. — manifest.json:4-15
Uses document.execCommand('copy') from the AI dialog's explicit Copy action; it does not read clipboard contents. — wscbundle/wscbundle.js:58
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends words, sentence-sized tokens, autocomplete context, and user-selected rewrite text to the configured WProofreader service. The traffic implements the advertised writing features; no unrelated advertising or analytics recipient was found.
Builds spell, grammar, combined check, autocorrect, autocomplete, and generate requests containing text or tokens and posts them to the configured service URL. — wscbundle/wscbundle.js:40
Sends preceding editor text for autocomplete and selected text plus a chosen prompt for AI generation. — wscbundle/wscbundle.js:50,58
Does it download or run code, settings, or instructions supplied by a remote server?
Its authenticated account services supplies the proofing service address, service/customer ID, user-dictionary name, ignored domains/protocols, and per-domain configuration. These are settings, not downloaded JavaScript.
Fetches /getUserInfo from app.wproofreader.com and stores the returned servicePath, serviceId, exclusions, and extraConfigRules. — background/background.js:1
Merges server-provided per-domain rules and service settings into the packaged proofreader configuration. — content/content.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Once the user is logged in, subscribed or in trial, and the site is allowed, it automatically monitors eligible editors and checks text while the user writes. Global, domain, URL, protocol, and account-state checks can stop it.
Starts auto-search only when account, subscription, ignored-domain/protocol, skipped-URL, and whitelist/blacklist conditions allow it. — background/background.js:1
Observes focused editors and triggers deferred checks as content changes. — wscbundle/wscbundle.js:50,61
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
The permission list is limited to activeTab, tabs, storage, unlimitedStorage, cookies, and scripting. — manifest.json:4-15
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most application files are minified Webpack bundles, which makes review harder. Product names, request fields, services, settings, and control paths remain visible; minification alone does not show concealment.
Contains a minified but structurally recognizable Webpack service worker. — background/background.js:1
Contains minified extension orchestration with readable API and configuration names. — content/content.js:1
Contains the bundled WebSpellChecker library plus its licenses and readable network command names. — wscbundle/wscbundle.js:1-61
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Legacy jquip AJAX code falls back to eval for JSON only if JSON.parse is missing and can eval responses explicitly requested as script; no packaged caller requests script responses. — wscbundle/wscbundle.js:43
A template helper compiles its template source with new Function; reviewed callers do not supply remotely returned template source. — wscbundle/wscbundle.js:44
The active proofing transport parses responseText with JSON.parse before delivering suggestions. — wscbundle/wscbundle.js:40
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests tabs but not history. — manifest.json:4-15
Uses tab URLs for local domain and exact-URL state decisions. — background/background.js:1
Proofing request fields include service/customer settings, language, text/tokens, and feature data but no explicit page URL field. — wscbundle/wscbundle.js:40
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Uses a configured customerid in proofing requests and local UIDs to distinguish editor instances; default statistics reporting is false. — wscbundle/wscbundle.js:40,44
Contains no analytics, fingerprinting, or generated advertising-ID flow. — background/background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads one cookie named wsc-logged from the configured WProofreader application origin and uses credentialed /getUserInfo requests for account configuration. No path reads arbitrary site cookies or sends credentials to an unrelated service.
Calls chrome.cookies.get with the configured auth origin and the fixed name wsc-logged, then fetches /getUserInfo with credentials included. — background/background.js:1
Declares cookies and broad host access, but reviewed cookie use is limited to the product's own login-state cookie. — manifest.json:4-15
Does it record typing, form entries, clipboard contents, or screenshots?
It reacts to typing and reads the changing contents of eligible textareas and rich editors for proofreading. This is not indiscriminate keylogging: ordinary input fields are excluded, and no screenshots or clipboard reads occur.
Configures automatic checking while disabling auto-search in input elements. — content/content.js:1
Listens for editor changes/keypress state, extracts text for checks and autocomplete, and observes eligible text containers. — wscbundle/wscbundle.js:50,59-61
Can a website or remote server send commands that make the extension take actions?
The proofing service supplies corrections, autocomplete text, and AI rewrites. Suggestions are normally user-visible and user-applied, while enabled autocorrect can replace a detected word automatically; no unrelated privileged command channel was found.
Processes remote proofing/generation responses and inserts a selected suggestion, accepted completion, or enabled autocorrection into the current editor. — wscbundle/wscbundle.js:40,50,58
Exposes user settings for suggestions, autocorrect, autocomplete, and the AI writing assistant. — content/content.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds problem markup and UI around editors and implements suggestion, autocorrect, autocomplete, and rewrite replacement paths. — wscbundle/wscbundle.js:50-61
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests none of downloads, webRequest, declarativeNetRequest, or proxy. — manifest.json:4-15
Uses ordinary XMLHttpRequest POSTs for proofreading. — wscbundle/wscbundle.js:40
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Does not request nativeMessaging. — manifest.json:4-15
Uses browser tabs, scripting, storage, cookies, runtime messaging, and HTTP requests without a native bridge. — background/background.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Stores servicePath and extraConfigRules returned by /getUserInfo. — background/background.js:1
Applies the returned service endpoint and per-domain configuration to the packaged proofreader. — content/content.js:1
Dynamic-code helpers are bundled, but no path from remote settings or proofing responses to their executable-source inputs was found. — wscbundle/wscbundle.js:43-44
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Listens for environmentReady, skipUrl, and checkExtensionAvailability document events; skipUrl only stores the current URL as locally skipped. — content/content.js:1
Exposes packaged resources broadly but declares no externally_connectable runtime messaging. — manifest.json:45-53
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Combines account validity, ignored domains/protocols, skipped URLs, and whitelist/blacklist state before enabling automatic checking. — background/background.js:1
Loads and applies extraConfigRules for the current hostname. — content/content.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background behavior is account, tab, settings, and script-injection coordination. — background/background.js:1
Bundled computation implements text parsing, editor markup, and proofing UI without a mining path. — wscbundle/wscbundle.js:1-61
Does it change form fields or where a form sends its information?
It edits textarea and contenteditable text when applying user-selected suggestions or AI output, and enabled autocorrect can replace a word automatically. It excludes ordinary input elements and does not change a form action, recipient, or submission destination.
Excludes input elements from automatic proofing. — content/content.js:1
Writes accepted suggestions, autocomplete, autocorrect, and AI completion text back into the active eligible editor; no form-action mutation exists. — wscbundle/wscbundle.js:50-61