Is eesel: AI agents for customer service & more safe?
We analyzed eesel: AI agents for customer service & more version 2.10.19's actual code and gave it a 58/100 trust score. This is a useful but broad-access…
Bottom line
This is a useful but broad-access AI extension that sends sensitive page content to its service and permits limited server-directed editing.
What it can access
It can read sensitive email and support content across every website, then send selected material to its service for AI features.[Q1][Q3][Q6][Q14]
Security weaknesses
Any webpage can change extension feature flags, while server-provided drafts may be inserted into empty helpdesk editors without a click.[Q8][Q16][Q21]
Signs of misuse
The package shows no proven deception, but it sends private page content and selected text to the provider and uses persistent analytics identifiers.[Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests scripting, tabs, storage, side-panel, and every-site access. Those powers support page-aware chat, saving tabs as knowledge, and helpdesk drafting, but the access is much broader than a typical extension.
Grants <all_urls> and injects both content.bundle.js and single-player.bundle.js on all matching pages. — manifest.json:permissions/host_permissions/content_scripts
Uses tab access to read the active page and optionally collect one or every open tab as AI knowledge. — sidepanel.bundle.js:modules 48886/45937
Which websites can it run on, and can it read or change what appears on those pages?
It runs on every ordinary website. Its fallback extractor converts the page body to text, while helpdesk-specific scripts add controls, read conversations, and can write drafts into reply editors.
Both packaged content scripts match <all_urls>. — manifest.json:content_scripts
Fallback extraction reads document.body.innerHTML; helpdesk logic locates and changes reply composers. — content.bundle.js:modules 31203/23839
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read sensitive page content, including Gmail messages, customer-support conversations, requester names and emails, internal comments, and selected text. I found no general password-field or keystroke collector.
Extracts Gmail threads and detailed Zendesk, Freshdesk, Gorgias, and Front ticket data. — content.bundle.js:modules 94472/26661/51698/3777
Re-extracts the page with the current selected text after selection changes. — content.bundle.js:selectionchange listener
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It relies on the signed-in session already present on Gmail and helpdesk pages to fetch private conversations, and it can enumerate open tabs. It does not request cookies, history, bookmarks, or downloads services.
Makes same-site authenticated requests for message and ticket content from the user's active signed-in applications. — content.bundle.js:Gmail/helpdesk extractors
Enumerates tabs and asks their content scripts to extract page data. — background.bundle.js:GET_TABS/GET_TAB_CONTENT
Contains no cookies, history, bookmarks, or downloads permission. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests none of the relevant device or management capabilities. — manifest.json:permissions
Creates DataTransfer and ClipboardEvent objects containing the generated reply rather than reading clipboard contents. — content.bundle.js:modules 10406/37102/813/72663
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
AI chats send user messages plus extracted page, email, or ticket context to oracle.eesel.app. Explicit save-page/save-tabs actions upload page titles, URLs, and converted contents for indexing.
Posts chat messages, invocation metadata, tools, and context-derived prompts to https://oracle.eesel.app/assistant/invoke. — single-player.bundle.js:generateAssistantResponse
Uploads selected page bodies, titles, and source URLs to eesel document-ingest endpoints. — sidepanel.bundle.js:modules 45937/65371
Initializes Amplitude with default UI event tracking enabled. — sidepanel.bundle.js:module 79733
Does it download or run code, settings, or instructions supplied by a remote server?
eesel supplies AI replies, tool descriptions, agent settings, prepared drafts, and account configuration that packaged code acts on. No JavaScript is downloaded or executed, and new Function occurrences are bundle-loader fallbacks only.
Processes server-provided streamed replies, task state, agent definitions, and tool-related responses. — single-player.bundle.js:assistant/invoke and API client
Fetches a prepared draft from the eesel dashboard API and inserts its content through fixed packaged editor adapters. — content.bundle.js:module 23839
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
While the side panel is open it automatically re-extracts the active page when tabs or URLs change. On supported helpdesk tickets it can fetch and insert a prepared reply automatically, without a click for that draft, but it does not send the reply.
Requests fresh active-tab context whenever the connected side panel follows a tab or URL change. — background.bundle.js:tabs.onUpdated/tabs.onActivated
Polls for an empty supported composer, fetches the latest prepared draft, and injects it if it has not already been used. — content.bundle.js:module 23839 C
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings, proxy, search, or management permissions. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is spread across several minified Webpack bundles, including a 2.4 MB shared chunk and a 1.35 MB all-sites content bundle. That substantially impedes inspection even though strings and module boundaries remain visible.
Large one-line minified dependency and application bundle. — 496.bundle.js:entire file
Large minified content application running on all matching pages. — single-player.bundle.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses new Function('return this') only if globalThis and window-style fallbacks are unavailable. — single-player.bundle.js/sidepanel.bundle.js/onboarding.bundle.js:Webpack bootstrap
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Tracks the active page only while the side-panel port is connected. — background.bundle.js:tabs.onUpdated/tabs.onActivated
Keeps extracted active-page context in the side-panel state for chat. — sidepanel.bundle.js:module 48886
Amplitude default tracking runs in the extension UI rather than the visited page context. — sidepanel.bundle.js:module 79733
Does it create a persistent ID or browser fingerprint to recognize you?
The bundled Amplitude client creates and retains device and session identifiers for extension-UI analytics. eesel also associates requests with authenticated workspace, namespace, agent, and task identifiers.
Initializes Amplitude with a fixed project key and default tracking, whose SDK persists a device ID. — sidepanel.bundle.js:module 79733 and Amplitude bundle
Sends session, connection, prompt, and task metadata with assistant requests. — single-player.bundle.js:generateAssistantResponse
Does it send cookies, session details, authentication data, or page contents elsewhere?
Private page contents—including Gmail/helpdesk conversations and customer identity fields—can be sent to eesel as AI context or indexed knowledge. Dashboard requests use the user's eesel session; the code does not extract Chrome cookies directly.
Builds AI prompts from private messages, tickets, comments, requester names, and requester email addresses. — content.bundle.js:extractor modules
Sends the constructed message/context payload to oracle.eesel.app with an authorization token. — single-player.bundle.js:generateAssistantResponse
Performs requested dashboard/oracle fetches with credentials included. — background.bundle.js:PROXY_REQUEST
Does it record typing, form entries, clipboard contents, or screenshots?
It records selected text and reads page/helpdesk message contents, including text already present in reply composers to decide whether they are empty. It does not continuously capture keystrokes, screenshots, or the real clipboard.
Reads window.getSelection and re-extracts page context around the selection. — content.bundle.js:selectionchange listener
Reads current helpdesk editor text before deciding whether a prepared draft may be inserted. — content.bundle.js:modules 10406/37102/813/72663
Can a website or remote server send commands that make the extension take actions?
The eesel server can provide a prepared support reply that the extension inserts into an empty composer. Its AI service also returns agent/tool results and settings.
Fetches /proxy/agents/drafts/latest and injects returned draft.content into supported editors. — content.bundle.js:module 23839
Normal generated replies expose a user-facing Paste into helpdesk action. — sidepanel.bundle.js:INJECT_REPLY UI
Enables server-mediated agent and live-tool response handling. — single-player.bundle.js:assistant/invoke
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Page changes are limited to AI controls, status favicons, and helpdesk reply insertion. — content.bundle.js/single-player.bundle.js:reviewed application paths
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No traffic interception, proxy, or download permission is present. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is requested. — manifest.json:permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Converts HTML to Markdown and generated Markdown back to editor HTML without passing it to eval or Function. — content.bundle.js/single-player.bundle.js:data conversion and rendering paths
Can ordinary websites access privileged extension features through messaging or exposed files?
Any webpage can post a feature_override message naming an arbitrary storage key, and the page access sets that key to true without an origin, allowlist, or secret check. Pages can also fingerprint the extension through its ping reply and web-accessible bundles.
Accepts a same-window page message and writes {[feature]: true} to chrome.storage.local with no feature-name validation. — content.bundle.js:feature_override message listener
Replies EESEL_EXTENSION_PONG to a page message. — content.bundle.js:EESEL_EXTENSION_PING listener
Exposes every *.bundle.js to every URL. — manifest.json:web_accessible_resources
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Gates autofill by helpdesk type, ticket identity, local flags, current editor state, and server draft availability. — content.bundle.js:module 23839
Uses remotely returned agents, namespaces, permissions, and feature state to select capabilities. — single-player.bundle.js/sidepanel.bundle.js:feature and agent configuration
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runs locator checks on a 500 ms interval to add or remove AI controls near supported editors. — single-player.bundle.js:bootstrap m/v
Does it change form fields or where a form sends its information?
It deliberately changes helpdesk reply inputs. A server-prepared draft may be inserted automatically only when the composer is empty; user-selected AI replies can also be pasted on request.
Writes generated text or rendered Markdown into Zendesk, Gorgias, Intercom, and Freshdesk editors and dispatches input/change events. — content.bundle.js:modules 10406/37102/813/72663
Automatically injects the newest prepared draft into a NORMAL_EMPTY composer and records a hash to prevent reinsertion. — content.bundle.js:module 23839
No form action rewrite or automatic submit call was found. — content.bundle.js:complete form-action review