Is S3 Browser & Cloud Storage AI Manager — Stream Vessel safe?
We analyzed S3 Browser & Cloud Storage AI Manager — Stream Vessel version 1.8.0's actual code and gave it a 65/100 trust score. This is a legitimate but…
Bottom line
This is a legitimate but high-access cloud-storage manager with sensitive data handling and some security concerns.
What it can access
It can manage connected cloud files and credentials, while optional access covers any HTTP or HTTPS site; this fits its purpose but creates substantial exposure. [Q1][Q3][Q5][Q6]
Security weaknesses
User-approved connections may reach private-network services, and the large compressed package makes safety review harder. [Q19][Q10]
Signs of misuse
The package sends credentials, files, and usage details to intended services, but the evidence does not establish theft, deception, or unrelated collection. [Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has broad but mostly user-mediated network and account access: storage, identity, analytics, and optional access to any HTTP or HTTPS storage host. It does not receive ordinary webpage access by default.
Requests storage, alarms, identity, Google Analytics host access, and optional http://*/* plus https://*/* origins; declares no content script. — manifest.json:1-34
Builds the narrow origin patterns needed for configured S3 endpoints and explicitly checks or prompts for optional host grants before transfers. — chunk-PHTUXKQT.js:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content_scripts, scripting permission, activeTab permission, or web-accessible application bridge. — manifest.json:1-34
The packaged file is empty and is not registered by the manifest. — content-script.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Users can type S3 access keys and secret keys or WebDAV usernames and passwords into the extension's own forms. It cannot observe credentials entered on unrelated websites.
Defines local/cloud S3 forms with accessKey and secretKey fields and a WebDAV form with username and password fields. — chunk-STTCGDZV.js:10,73
No content script or page-access mechanism exists to read website login or payment forms. — manifest.json:1-34
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It obtains and stores security-sensitive sessions for its own service and connected providers, including a Stream Vessel bearer token, Google Drive OAuth token in memory, and optional GitHub tokens. It cannot read browser cookies or unrelated site sessions.
Stores auth.clientToken, including bearer token, expiry and email, through the extension storage service and attaches it to backend requests. — chunk-DOHDMKVU.js:1
Uses chrome.identity OAuth for drive.file access and caches the returned Google token in memory; GitHub device-flow tokens are also supported when that feature is enabled. — chunk-STTCGDZV.js:10
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read and write files explicitly selected in the app and any object reachable through connected cloud accounts. It has no camera, microphone, location, native-filesystem, or installed-app inventory permission.
Implements object listing, streaming downloads, uploads, text editing, copy/move, metadata, folder creation and deletion for connected storage. — chunk-STTCGDZV.js:10
Requests no camera, microphone, geolocation, nativeMessaging, or broad local-filesystem capability. — manifest.json:1-34
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends account/auth data and cloud-connection credentials to Stream Vessel's backend, storage operations to configured providers, usage telemetry to Google Analytics, and device-download streams through a third-party StreamSaver page.
Configures app.streamvessel.com/be as the backend and posts enabled GA4 page views, feature events, a client ID and device context to google-analytics.com. — chunk-DOHDMKVU.js:1
Cloud S3 create/update/test requests include connection forms with accessKey and secretKey; provider calls and presigned transfers handle storage data. — chunk-STTCGDZV.js:10
StreamSaver's active local-download path transfers the ReadableStream to a hidden jimmywarting.github.io page/service worker. — chunk-STTCGDZV.js:1,10
Does it download or run code, settings, or instructions supplied by a remote server?
Remote services supply account state, connection records, share permissions, file listings, presigned transfer URLs and MCP commands that determine storage operations. No remote executable code is loaded.
The /s3/connections and /s3 APIs return cloud connections, listings and presigned download/upload links used by the client. — chunk-STTCGDZV.js:10
MCP tokens connect external AI clients to the backend /mcp endpoint with READ, WRITE or FULL storage scopes. — chunk-IUBIBA7K.js:3
Extension CSP restricts scripts to self and no runtime code-loader was found. — manifest.json:26-28
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The background worker checks Chrome for extension updates every six hours and records update state. Storage access and file operations otherwise require the app, an authenticated share, or an MCP request.
Creates a six-hour alarm, calls chrome.runtime.requestUpdateCheck and records update availability. — background.js:10-45,72-115
A pending post-update reopen is accepted only briefly and only for an extension-origin URL. — background.js:48-69
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings, search, override, proxy, privacy, management, or declarativeNetRequest capability. — manifest.json:1-34
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most of the 32 MB unpacked application is minified into large one-line Angular, AWS SDK, WebDAV and editor bundles. Names and strings remain partly readable, but exhaustive manual review is materially harder.
Records the large production package and numerous minified JavaScript chunks and Monaco worker assets. — inventory.json:1
Combines application logic with large minified dependencies in megabyte-scale generated bundles. — chunk-STTCGDZV.js:1-73
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Direct sink review across packaged runtime JavaScript found zero eval, Function-constructor, or string-timer calls. — inventory.json:1
Lazy route imports reference fixed relative chunk filenames included in the package. — main-INYVU4HB.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Defines page_view plus named events for connection, explorer, upload/download/delete, search, sharing, onboarding and MCP actions. — chunk-DOHDMKVU.js:1
No webpage/history access exists, so this telemetry is limited to extension usage and supplied event parameters. — manifest.json:1-34
Does it create a persistent ID or browser fingerprint to recognize you?
Google Analytics is enabled by default and uses a persistent random client ID plus session IDs, route, language, screen resolution, timezone-derived country and browser/OS details.
GA configuration is enabled and loadOrCreateClientId stores crypto.randomUUID() as ga_client_id in chrome.storage.local. — chunk-DOHDMKVU.js:1
The GA payload may include language, resolution, browser/version, OS/version and country inferred from timezone. — chunk-DOHDMKVU.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
Highly sensitive data can leave the browser: cloud-mode S3 credentials go to Stream Vessel, provider tokens and file contents go to their intended services, and device-download bytes pass through the StreamSaver helper origin.
Cloud connection create/update/test payloads carry accessKey and secretKey to app.streamvessel.com/be/s3/connections. — chunk-STTCGDZV.js:10
Cloud file operations use backend APIs and presigned links; device S3/WebDAV/Drive operations send file data to the configured provider. — chunk-STTCGDZV.js:10
Local download bytes are piped to StreamSaver.createWriteStream, whose MITM is jimmywarting.github.io/StreamSaver.js/mitm.html. — chunk-STTCGDZV.js:1,10
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests no clipboardRead, tabCapture, desktopCapture, camera, microphone, activeTab or content-script access. — manifest.json:1-34
Clipboard references implement the app's internal copy/move queue or packaged UI widgets; no background clipboard reader was found. — chunk-STTCGDZV.js:1-73
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Builds Claude/Cursor/VS Code configurations for the backend MCP URL and creates READ, WRITE or FULL bearer tokens. — chunk-IUBIBA7K.js:3
The UI says the token is shown once, only a SHA-256 hash is retained server-side, and tokens can expire or be revoked. — chunk-IUBIBA7K.js:3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content script or webpage injection capability is declared. — manifest.json:1-34
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, webRequestBlocking, declarativeNetRequest, proxy or downloads permission. — manifest.json:1-34
AWS signing is scoped to requests created by the bundled S3 client for configured connections. — chunk-RPVGLY6B.js:1
Can it communicate with software on the computer or services running on localhost?
User-configured WebDAV or S3-compatible services can target localhost and private-network IP addresses. Plain HTTP passwords are allowed only for literal localhost/private addresses; public names are refused unless HTTPS is used.
WebDAV URL validation allows HTTP only for localhost, ::1, 10/8, 127/8, 192.168/16 and 172.16/12 and rejects public/named hosts. — chunk-STTCGDZV.js:73
Optional HTTP/HTTPS host permissions can authorize the selected private endpoint; no nativeMessaging permission exists. — manifest.json:20-25
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
CSP allows scripts only from the extension package. — manifest.json:26-28
Dynamic-code and remote-script review found no data-to-code sink. — inventory.json:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable, content_scripts or web_accessible_resources entry is present. — manifest.json:1-34
Registers lifecycle, alarm, update, toolbar and error listeners only; no message or connection listener exists. — background.js:1-140
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Production feature flags and extension target are packaged constants; account readiness and chosen connection type select expected product flows. — chunk-DOHDMKVU.js:1
Local and cloud connection dispatch is explicit and reflected in the UI and connection type. — chunk-STTCGDZV.js:10
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is limited to infrequent Chrome update checks and update-state storage. — background.js:10-115
Workers and multipart pipelines support file editing/search/transfers and have visible product call sites. — chunk-STTCGDZV.js:10
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No website content script or page injection capability exists. — manifest.json:1-34
S3 and WebDAV form values feed connection services directly; no external form-action rewrite logic was found. — chunk-STTCGDZV.js:10,73