Is AI Spreadsheets Visualization safe?
We analyzed AI Spreadsheets Visualization version 1.2's actual code and gave it a 55/100 trust score. Broad website access and exposed storage credentials…
Bottom line
Broad website access and exposed storage credentials create significant privacy and security concerns despite user-initiated uploads.
What it can access
It runs on every website and uploads complete user-selected CSV or JSON files to outside services, broader and more sensitive than the visualization feature requires. [Q1] [Q3] [Q6]
Security weaknesses
The extension exposes storage credentials in its packaged code, while much of its bundled code is difficult to inspect, increasing misuse risk. [Q6] [Q10]
Signs of misuse
Uploads are user-initiated and disclosed, with no evidence of covert tracking, remote commands, or other misuse. [Q14] [Q16] [Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests identity, email and synchronized storage, then injects the Alibaba OSS SDK on every website. The popup's spreadsheet upload does not require all-sites page access, and the normal visible interface does not currently use the identity permissions.
Declares identity, identity.email and storage, plus an ali_oss.js content script matching every URL. — manifest.json:9-22
The advertised operation starts from a CSV/JSON file picker in the extension popup, not from arbitrary webpages. — popup.html:475-476
Which websites can it run on, and can it read or change what appears on those pages?
A bundled storage SDK runs in Chrome's isolated content-script world on every website, giving this extension code latent page access. In the analyzed package the SDK defines library functions only; no complete path reading, changing or transmitting page content was found.
Loads ali_oss.js at document_idle on all URLs. — manifest.json:17-22
Contains the bundled Alibaba OSS client and dependencies; no extension-specific DOM collection or active upload call appears in this content-script file. — ali_oss.js:1-31491
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The selected CSV or JSON can contain private business, financial or personal data. A complete active path takes that user-selected file to Alibaba storage, then sends its resulting URL to the LivePolls visualization page.
Reads the selected CSV/JSON File, uploads it with ossClient.put and opens LivePolls with the returned file URL. — popup.js:218-247
The visible picker accepts CSV and JSON and states that uploaded data is automatically deleted daily. — popup.html:475-489
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares identity, identity.email and storage, but not cookies, history, bookmarks or downloads. — manifest.json:9-13
Uses getProfileUserInfo only during the login handler and sends the Google user ID to the ImgKits passport endpoint. — background.js:483-518
The account/login interface is commented out in the shipped popup. — popup.html:524-548
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads one local CSV or JSON file after the user explicitly chooses it, then uploads the full file. It has no general filesystem, clipboard, location, camera, microphone or screen-capture access.
Provides a visible user-operated file picker limited to CSV and JSON. — popup.html:475-489
Takes event.target.files[0], validates its MIME type and passes the complete File object to OSS put. — popup.js:218-239
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The selected file goes to the californian Alibaba OSS bucket, and its statics.imgkits.com URL goes to livepolls.app for visualization. Critically, the active popup exposes an Alibaba access-key ID and secret.
Constructs the active OSS client with a literal accessKeyId, accessKeySecret, accelerate endpoint and californian bucket. — popup.js:158-164
Uploads the selected file, rewrites the returned storage URL to statics.imgkits.com and puts that URL in a LivePolls query parameter. — popup.js:218-247
Discloses that a selected file is uploaded and claims daily deletion. — popup.html:475-489
Does it download or run code, settings, or instructions supplied by a remote server?
ImgKits remotely supplies a More Apps catalog whose URLs open only after the user selects an item. Remote services responses also provide account status and image-processing results in mostly dormant legacy code.
Fetches a product recommendation list and opens the selected returned URL in a tab. — popup.js:1-29
Processes fixed ImgKits JSON API responses as account data rather than code. — background.js:586-706
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
The upload handler is attached to the visible file input's change event. — popup.js:218-247
On installation, sets a fixed LivePolls uninstall URL and stores the result of the ImgKits account-status request. — background.js:21-40
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no search, homepage, proxy, privacy or browser-settings permission. — manifest.json:9-22
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most package size is a third-party Alibaba OSS bundle. The extension-specific scripts remain readable.
Shows ali_oss.js is about 1.17 MB while background.js and popup.js are small readable scripts. — inventory.json:1
Contains the active literal Alibaba access-key ID, secret and bucket configuration. — popup.js:158-164
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Evaluates only a hard-coded local require expression inside a try/catch when a module environment is available. — ali_oss.js:18838-18849
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
The all-sites content script consists solely of ali_oss.js. — manifest.json:17-22
Defines a storage client and bundled dependencies without extension-specific visit logging or an automatically invoked upload. — ali_oss.js:1-31491
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Generates a new random suffix for each temporary uploaded object. — popup.js:115-139,236-239
Stores a first-party ImgKits login passport only after the login flow obtains one. — background.js:483-505
Does it send cookies, session details, authentication data, or page contents elsewhere?
The complete selected spreadsheet is sent to Alibaba storage, and its returned URL is sent to LivePolls. This is active, user-initiated product behavior rather than covert send data out; the popup says data is uploaded and deleted daily.
Passes the File directly to the HTTPS OSS client and sends the resulting URL to an HTTPS LivePolls page. — popup.js:218-247
Labels the action Upload file and states that uploaded data is automatically deleted daily. — popup.html:475-489
Does it record typing, form entries, clipboard contents, or screenshots?
It uploads the full contents of a file the user selects. It does not monitor keyboard input, form fields, clipboard contents, screenshots, camera or microphone, and no automatic collection occurs before file selection.
The only user-content source is the chosen CSV/JSON File object. — popup.js:218-239
Declares no clipboard, capture, camera or microphone permission. — manifest.json:9-22
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote product URLs open only after selection in the extension popup. — popup.js:1-29
Fixed API responses are treated as account or processing data, not privileged command objects. — background.js:586-706
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Populates a More Apps dropdown from ImgKits data and opens the chosen product URL. — popup.js:1-29
Shows the More Apps control in the popup footer. — popup.html:551-554
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, webRequest, declarativeNetRequest or downloads permission. — manifest.json:9-22
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission; reviewed destinations are public HTTPS services. — manifest.json:9-22
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The only explicit eval receives a fixed require expression. — ali_oss.js:18838-18849
Remote handling uploads a selected file and opens a result URL without interpreting returned text as code. — popup.js:218-247
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Runs ali_oss.js on all URLs but declares no externally_connectable or web_accessible_resources entry. — manifest.json:17-22
Handles internal runtime messages without exposing a webpage bridge; the packaged content script sends none of these messages. — background.js:43-54
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Applies the same content script uniformly to all matched URLs. — manifest.json:17-22
Activates upload from the visible file-input change handler. — popup.js:218-247
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains a general storage SDK and dependencies without an automatically invoked upload or mining workload. — ali_oss.js:1-31491
Background startup performs a small account-status request and install setup. — background.js:21-40
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Defines the extension's own CSV/JSON upload control. — popup.html:475-489
No extension-specific form listener or action rewrite was found in the all-sites content script. — ali_oss.js:1-31491