Is Graph maker safe?
We analyzed Graph maker version 1.03's actual code and gave it a 88/100 trust score. Graph maker is narrowly scoped and mostly local, with only minor…
Bottom line
Graph maker is narrowly scoped and mostly local, with only minor concerns from automatic external pages and selected-file access.
What it can access
It requests no browser or website access and only reads files you select for its graph editor.[Q1][Q5]
Security weaknesses
The main weakness is automatic opening of an unencrypted publisher page during installation, though no remote command path was found.[Q8][Q16]
Signs of misuse
No evidence shows tracking, sensitive-data collection, or misuse; the package only opens publisher pages and uses external fonts or feedback links.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
No evidence of this behavior was found in the reviewed package.
Declares permissions: [] and no host_permissions, content_scripts, overrides, or web-accessible resources. — manifest.json:1-29
The toolbar click creates only tabs/app.html and does not inspect the originating tab. — background.js:1-5
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content script, scripting permission, or host access. — manifest.json:1-29
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The editable fields are part of the packaged chart application. — tabs/app.html:53-154
Paste handling reads text only from a paste event inside the chart table and inserts it using textContent. — script.js:997-1039
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests no browser-data permissions. — manifest.json:1-29
Uses chrome.tabs only to open fixed URLs and does not read any tab object fields. — background.js:1-20
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read a CSV or XLSX file only after the user selects it through the editor's file picker. No arbitrary filesystem, camera, microphone, location, clipboard permission, installed-app, or native access exists.
Provides a user-facing file input restricted to .csv and .xlsx. — tabs/app.html:53-70
Reads the selected file with FileReader and parses it locally as CSV or XLSX. — script.js:2886-3024
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It automatically opens the publisher's HTTP welcome page on first install, registers a Google Forms uninstall survey, and its editor references Google Fonts. No chart, file, or table data is sent in these paths.
Opens http://imagecropper.tilda.ws/graphmaker on install and sets a forms.gle uninstall URL. — background.js:7-20
References a Montserrat stylesheet and font host at fonts.googleapis.com and fonts.gstatic.com. — tabs/app.html:6-8
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads packaged Chart.js, SheetJS, script.js, and resizer.js files. — tabs/app.html:156-159
Extension CSP restricts executable scripts to self. — manifest.json:8-10
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On first installation it automatically opens an unencrypted publisher welcome page. Other external pages open only after a rating choice or uninstall event, and chart actions are user-driven.
Handles the install reason by creating an active HTTP tab and registers a separate uninstall URL. — background.js:7-20
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no relevant permission or browser override. — manifest.json:1-29
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party behavior is readable, but packaged Chart.js and SheetJS libraries are large minified files. Several unrelated C# source files are inert package clutter and are not loaded by the extension.
Contains the packaged minified Chart.js renderer. — libs/chart.umd.min.js:1
Contains the packaged minified SheetJS spreadsheet parser. — libs/xlsx.full.min.js:1
Shows the actual runtime file set; none of the C# files is loaded. — tabs/app.html:156-159
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Direct sink searches across all packaged JavaScript found no actual eval/new Function call; Chart.js matches were method names such as _tickFormatFunction. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
The only localStorage writes save infoContent and userRating; no page URL or browsing record is collected. — script.js:646-706,750-855
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Network, storage, and identifier review found only fixed external navigation/font references and no telemetry transport. — inventory.json:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies, identity, page, or host access. — manifest.json:1-29
File data is parsed and inserted locally with no network call. — script.js:2886-3024
Does it record typing, form entries, clipboard contents, or screenshots?
It reads plain text explicitly pasted into its own editable data table. It has no clipboard permission and does not monitor background clipboard changes, typing on websites, forms, or screenshots.
A paste handler on #dataTable calls event.clipboardData.getData('text') and inserts the cells with textContent. — script.js:997-1039
Requests no clipboard or capture permission and has no content script. — manifest.json:1-29
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Registers only toolbar-click and installation listeners. — background.js:1-20
Defines no runtime/window message receiver or network control loop. — script.js:1-3260
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Rating choices open either a Google feedback form or the extension's Web Store review page; no webpage content is modified. — script.js:712-805
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:1-29
Renders the chart to a local canvas data URL and clicks a download anchor. — script.js:2009-2037
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or host permission. — manifest.json:1-29
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
SheetJS output is converted to strings and placed in table cells with textContent. — script.js:2980-3024
Extension CSP permits scripts only from the package itself. — manifest.json:8-10
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes no website-facing runtime surface. — manifest.json:1-29
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches only on Chrome's install versus update lifecycle reason. — background.js:7-20
Rating destinations depend solely on the user's chosen number of stars. — script.js:768-805
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains no compute loop or background task. — background.js:1-20
Resource-heavy rendering and parsing are directly tied to save/import actions. — script.js:1980-2037,2886-3024
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no content script or page access. — manifest.json:1-29
Editor inputs and table are packaged UI elements, not injected webpage forms. — tabs/app.html:53-154