Is Creator Insights - Social Media Distribution & Analytics tool safe?
We analyzed Creator Insights - Social Media Distribution & Analytics tool version 9.8511's actual code and gave it a 42/100 trust score. This is a…
Bottom line
This is a powerful social-media automation extension with broad access and a serious website-to-extension control weakness.
What it can access
It can read and change pages across many sites, store account and publishing data, and automate posts; this broadly fits its purpose but is extensive. [Q1] [Q2] [Q3] [Q6]
Security weaknesses
Page messages lack adequate origin checks, while dashboard and backend commands can trigger posting and use server-supplied automation instructions. [Q21] [Q16]
Signs of misuse
No unrelated advertising manipulation or mining was found, but remote services can direct automated posting and page actions through the extension. [Q17] [Q23] [Q7] [Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has all-site host access plus tabs, scripting, storage, side-panel, offscreen, display, and tab-group capabilities.
Declares broad browser permissions, named social/API hosts, localhost, and <all_urls>. — manifest.json:7-63
Which websites can it run on, and can it read or change what appears on those pages?
It reads and modifies content on major social networks and supported AI-chat pages to analyze content and automate publishing.
Injects analytics, authentication, posting, and assistant scripts across supported sites. — manifest.json:82-258
Reads selected Instagram and YouTube API responses and publishes extracted feed items to the isolated content script. — feedInterceptor.js:540-611
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads social posts, comments, profiles, account identity details, and user-authored publishing content; no payment-data collection was found.
Extracts channel name, handle, avatar, and email for account connection. — multiplatform/authentication/youtube.js:363-418
Loads platform-specific posting and analytics scripts into authenticated social sites. — manifest.json:98-258
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores service tokens, connected-account metadata, post data, captured analysis results, and media caches in extension storage.
Stores the Creator Insights JWT and exposes it to internal extension components. — env.js:159-207,640-720
Stores detected social-account metadata in multipost_accounts. — multiplatform/platform_manager.js:1198-1224
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can capture the visible tab, write images to the clipboard, cache fetched media, and initiate local downloads for user-facing content tools.
Fetches media, writes images through an offscreen document, and captures the visible tab. — env.js:2059-2116
Creates user-initiated image downloads and falls back to visible-tab capture. — postActions.js:2260-2325
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends account, post, analytics, capture, and publishing data to Creator Insights and sends normal authenticated requests to the social services being used.
Sends a requested Instagram audit to the Creator Insights API with the stored service token. — contentScript.js:3029-3055
Sends post status, links, metadata, and errors to the configured backend. — multiplatform/platform_manager.js:1696-1758
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads encrypted selectors from a backend; those server-controlled selectors determine which page elements authentication and posting automation interact with.
Fetches, decrypts, and returns remote posting and authentication selector sets. — multiplatform/platform_manager.js:1775-1974
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Once a dashboard distribution or analysis task starts, it can open background tabs, scrape profiles, post content, and report results automatically.
Creates background tabs for scraping and starts multi-platform distribution from dashboard commands. — multiplatform/platform_manager.js:1985-2060,2667-2727
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browserSettings, privacy, proxy, or search-provider permissions. — manifest.json:7-20
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses readable, feature-oriented modules and comments. — multiplatform/platform_manager.js:1-40
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
importScripts loads fixed packaged extension modules. — env.js:61-87
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Declares tabs and all-site host access. — manifest.json:7-63
External dashboard messages can navigate the active tab or open a supplied URL. — env.js:276-294
Does it create a persistent ID or browser fingerprint to recognize you?
It records platform account identifiers and post identifiers needed for analytics and publishing; unrelated advertising or fingerprinting was not demonstrated.
Collects channel identity metadata for account connection. — multiplatform/authentication/youtube.js:363-418
Extracts created-post identifiers and URLs for supported platforms. — feedInterceptor.js:300-529
Does it send cookies, session details, authentication data, or page contents elsewhere?
It uses the user's existing signed-in social sessions and stores a Creator Insights JWT. Password elements are checked only for login-state detection; password values are not read.
Queries for a visible password field only to classify the page as logged out. — multiplatform/authentication/youtube.js:132-176
Stores and returns the Creator Insights JWT within the extension. — env.js:159-176,674-690
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture the visible tab and sample video frames through explicit capture and video-analysis workflows; no background keystroke logger was found.
Captures only after an internal request or keyboard command starts the capture flow. — env.js:2112-2116,2227-2247
Packages user-reviewed video frames and sends them to the Creator Insights analysis iframe. — contentScript.js:5550-5607
Can a website or remote server send commands that make the extension take actions?
A trusted dashboard or localhost page can start posts and select an unrestricted backend; that server supplies selectors used for privileged page automation.
Allows external messages from the vendor dashboard and localhost:3000. — manifest.json:58-63
Accepts backendUrl, sends the stored JWT there, consumes returned selectors, and starts distribution commands. — multiplatform/platform_manager.js:1764-1773,1824-1974,2667-2727
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Loads platform-specific automation and posting modules into authenticated social sites. — manifest.json:98-258
Dashboard START_MULTI_POST commands launch the publishing workflow. — multiplatform/platform_manager.js:2667-2727
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It wraps page fetch/XHR responses to extract feed and post-result data, and it fetches user-selected media; it does not configure a browser proxy or redirect all traffic.
Clones selected page responses for local extraction while returning the original response unchanged. — feedInterceptor.js:540-611
Fetches requested media into extension storage for content workflows. — env.js:674-760
Can it communicate with software on the computer or services running on localhost?
It explicitly trusts a localhost web origin, but no native messaging, shell commands, or local-service protocol beyond ordinary HTTP was found.
Grants host and external-message access to http://localhost:3000 while requesting no nativeMessaging permission. — manifest.json:53-63
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
It downloads remote selectors and authentication instructions, but no remote JavaScript execution was found. The selector mechanism is confirmed; the current server data was not inspected.
Downloads encrypted selector data, decrypts it, validates only that a selectors object exists, and returns it to automation code. — multiplatform/platform_manager.js:1775-1974
Can ordinary websites access privileged extension features through messaging or exposed files?
It exposes privileged bridges to allowlisted web origins and also accepts window messages without verifying event origin before triggering navigation and video-analysis actions.
Makes the extension externally connectable from the dashboard and localhost. — manifest.json:58-63
Accepts page messages without checking event.origin or event.source, stores supplied prompts/media, and asks the background worker to open supplied URLs. — contentScript.js:4111-4137,4182-4206
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Dashboard commands start bounded automated jobs with timeouts and abort support. — multiplatform/platform_manager.js:1985-2060,2667-2727
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Declared features and packaged modules concern analytics, capture, content assistance, and social publishing. — manifest.json:1-258
Does it change form fields or where a form sends its information?
It fills and submits social publishing inputs as a core feature. No code changing form actions to an unrelated collection server was demonstrated.
Loads dedicated post automation modules for each supported social service. — manifest.json:98-258
Starts the dashboard-supplied multi-platform posting workflow. — multiplatform/platform_manager.js:2667-2727