Is Add to Sheets - Save to Google Sheets in 1 click safe?
We analyzed Add to Sheets - Save to Google Sheets in 1 click version 1.6.3's actual code and gave it a 78/100 trust score. This is a generally…
Bottom line
This is a generally purpose-aligned Sheets-saving extension with medium access and security risk, but its all-webpage reading can include sensitive content.
What it can access
It can read pages on every website, store account state, and send chosen content to Sheets; this fits its purpose but is broad and may include sensitive page text. [Q1][Q2][Q6][Q14]
Security weaknesses
The main weakness is broad page-reading capability: a requested full-page capture may include sensitive text, although no code execution or website-to-extension bridge was found. [Q2][Q3][Q11][Q21]
Signs of misuse
No evidence shows tracking or remote commands; data sharing is tied to Sheets and account functions, while templates require user import. [Q6][Q12][Q16][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has storage and identity access, runs on all webpages, and requests Google Sheets plus limited Drive access for its advertised workflow.
Declares an all-URLs content script, storage, identity, context-menu and side-panel permissions, plus spreadsheets and drive.file OAuth scopes. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
It can read selected text, visible page text, links, media URLs, or full HTML when a clipping action or saved automation requests them.
GET_PAGE_HTML, GET_PAGE_CONTENT, and GET_PAGE_SELECTION handlers clone or serialize page content and return it to extension code. — content.7f229555.js:17
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Full-page workflows can include sensitive text or markup present in the page, while simple clipping limits input to the item the user selected.
The content handler can return body text, head or body HTML, full document HTML, or only the current selection depending on the requested workflow input. — content.7f229555.js:17
The clipping handler chooses linkUrl, selectionText, pageUrl, or media srcUrl and sends the result to the configured Sheet target. — static/background/index.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores account state, Google access credentials, Sheet destinations, shortcuts, and saved automations in extension-local storage.
Uses Plasmo and WXT local storage for WAF tokens, user data, groups, targets, settings, shortcuts, and workflow definitions. — static/background/index.js:1,1562
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the related browser permissions. — manifest.json:3
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends user-selected or workflow-extracted content to the user's chosen Google Sheet; account and subscription requests go to AddtoSheets.
Writes rows through sheets.googleapis.com and sends authenticated account, token-refresh, status, and template requests to addtosheets.com. — static/background/index.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads vendor-provided automation templates that can describe what page content to extract and where to place it.
FETCH_AUTOMATION_TEMPLATES retrieves authenticated template JSON from addtosheets.com/api/v1/templates. — static/background/index.js:1562
The user must choose Import Template; the returned workflow is then loaded into the visible automation editor. — options.95eda3f3.js:1615-1616
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
A page access loads on every page, but no automatic page-data upload was found; sensitive work starts from a user action or previously configured shortcut.
Registers the content script for all URLs. — manifest.json:3
The page-reading paths are message handlers and do not run until extension code sends a matching request. — content.7f229555.js:17
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting, search-provider, or proxy permissions. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains ordinary Parcel-built application and library modules with descriptive strings and symbols. — static/background/index.js:1-1562
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No text-to-code execution primitive was found. — content.7f229555.js:1-192
No text-to-code execution primitive was found. — static/background/index.js:1-1562
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Page-content responses include window.location.href. — content.7f229555.js:17
Supports pageUrl input and the page_url, page_domain, and page_path workflow variables. — static/background/index.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
Authenticated account identifiers and email are used for login, billing status, and ownership checks; no cross-site advertising tracker was found.
Uses Firebase user IDs, email, and AddtoSheets customer status; workflows and destinations are restricted to the stored user ID. — static/background/index.js:1,1562
Does it send cookies, session details, authentication data, or page contents elsewhere?
It obtains Google OAuth and Firebase tokens for authenticated Sheet access and stores its web-auth access and refresh tokens locally; it does not read browser cookies or passwords.
Declares identity and Google user-info, spreadsheets, and drive.file OAuth scopes. — manifest.json:3
Obtains Chrome identity tokens or reads locally stored WAF tokens and attaches them as Bearer credentials to expected Google or AddtoSheets requests. — static/background/index.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
A user-run full-HTML automation can include form markup or sensitive page text, but no keystroke logging, live password-field capture, screenshot, camera, or microphone path was found.
The handler can serialize document.documentElement or document.body after an extension request; it registers no key or input listener for page data capture. — content.7f229555.js:17
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Template import is attached to visible Import buttons and loads the template into the local editor. — options.95eda3f3.js:1615-1616
Saved page-content automations execute from the user's side-panel action. — tabs/sidepanel.ef669f53.js:1627
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Mounts a Plasmo shadow-root toast container and otherwise clones page DOM only for reading. — content.7f229555.js:17
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It makes authenticated requests to Google Sheets, Google Drive, Firebase, and AddtoSheets, but does not intercept traffic, change proxies, or download executable files.
Contains fixed HTTPS API calls for authentication, subscription checks, templates, spreadsheet listing, and Sheet reads or writes. — static/background/index.js:1,1562
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or external-program permission. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches template JSON, validates workflow nodes, and dispatches only packaged node types such as page_content, find, filter, transform, table, and save_to_sheets. — static/background/index.js:1,1562
Requires the user to import the template into the editor before it can be saved or run. — options.95eda3f3.js:1615-1616
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Listens only on chrome.runtime.onMessage and exposes no window-message or DOM-event bridge to page scripts. — content.7f229555.js:17
Declares no externally_connectable websites. — manifest.json:3
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Routes a chosen selection, URL, media item, or workflow output to locally stored Sheet targets; workflow execution checks the owning user ID. — static/background/index.js:1,1562
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains spreadsheet, workflow, authentication, and UI dependencies rather than mining code. — static/background/index.js:1-1562
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Application logic reads cloned or serialized content and mounts isolated notifications; form-setting code belongs to bundled React internals, not extension behavior. — content.7f229555.js:17