Is AutoTDK - SEO Search Keyword Tool safe?
We analyzed AutoTDK - SEO Search Keyword Tool version 1.3.0's actual code and gave it a 72/100 trust score. This is a useful SEO extension with broad page…
Bottom line
This is a useful SEO extension with broad page access and moderate privacy concerns, but no demonstrated remote control or clear malicious abuse.
What it can access
It runs on every website, reads visible page content for SEO, and requests cookies and storage, although form fields are excluded.[Q1][Q2][Q3][Q4]
Security weaknesses
Broad page reach and cookie access increase potential impact, while bundled code makes review harder, though no exposed privileged interface was found.[Q1][Q10][Q14][Q21]
Signs of misuse
It sends page-related information and usage data to its service and analytics providers, but transfers are tied to opened features and no clear misuse is shown.[Q6][Q13][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects into every URL and requests storage and cookies. All-page access supports on-demand SEO analysis, but cookies is broader than the behavior I found.
Declares cookies and storage, selected host permissions, and a content script matching <all_urls>. — manifest.json:22-54
Which websites can it run on, and can it read or change what appears on those pages?
When its panel is opened, it reads the page's text, headings, links, images, Open Graph metadata, language links, and basic SEO tags.
The Th function clones the page, removes scripts/forms and extension UI, extracts text, and enumerates headings, links, images, and metadata. — content/content.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads visible page content for SEO and optional AI analysis, while explicitly excluding input, textarea, select, script, iframe, and style elements from its text extraction.
Clones documentElement and removes form controls and non-content elements before collecting text. — content/content.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores settings, a generated analytics client ID, account token/email, recent analyzed paths, and cached SEO results in extension storage.
Initializes settings and stores recent recordSite entries. — background.js:1
Reads and writes settings, token, email, clientId, and feature state through chrome.storage.local. — content/content.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can create local CSV downloads and copy or open SEO results through ordinary page services. It requests no camera, microphone, capture, notification, or Chrome downloads permission.
Builds CSV blobs and temporary download links for explicit export actions. — content/content.js:1
Requests only cookies and storage. — manifest.json:22-25
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends site origin/path for service initialization, hostname for SEO lookups, and up to 2,000 characters of page text for the optional AI detector. These transfers are connected to features the user opens or invokes.
Sends recordSite origin/path and AI-detector text/hostname to autotdk.com APIs. — background.js:1
Triggers those requests from the opened analysis panel and explicit AI-detection flow. — content/content.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses fixed packaged defaults and fixed AutoTDK API routes; responses are treated as feature data. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
A page access and hidden UI shell load on every page, but page extraction and site recording occur when the user opens the SEO panel. Installation also opens the AutoTDK website once.
Mounts the UI shell at load and performs the full Th page scan when the panel is toggled. — content/content.js:1
Opens an AutoTDK marketing page once on install or update. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings, proxy, declarativeNetRequest, or search-override capability. — manifest.json:22-54
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application is bundled and minified, which makes review harder, but readable routes, strings, and control flow remain. Deliberate packing or encrypted code was not demonstrated.
Contains a roughly 418 KB minified Vue/Webpack application with readable feature strings and API paths. — content/content.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The only Function constructor is a fixed global-object compatibility helper near the bundle runtime. — content/content.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Stores window.location fields, enumerates page links, and requests recordSite for the current origin/path. — content/content.js:1
Sends recordSite o and p parameters to autotdk.com. — background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent random client ID and sends panel-tab interaction events to Google Analytics. The shown analytics data includes event labels, not the page URL or content.
Creates clientId with crypto.randomUUID and posts statistics events to Google Analytics Measurement Protocol. — content/content.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares the cookies permission. — manifest.json:22-25
Registers a cookie-change listener that only conditionally calls console.log and performs no network send. — background.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It can read visible page text for SEO and AI analysis, but it excludes input and textarea elements and does not install a general keystroke listener. The only key listener handles documented Ctrl-Alt shortcuts.
Excludes form controls during content extraction and listens only for Ctrl-Alt-D/S/R shortcuts. — content/content.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Uses fixed message types and routes; server data is returned to the requesting feature. — background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Mounts the AutoTDK interface and optionally marks server/client-rendered page elements with CSS classes. — content/content.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It makes requests to AutoTDK, Google Analytics, the current site's sitemap/robots files, and several SEO services. It does not intercept traffic or configure a proxy.
Provides sitemap, robots, keyword, login, SEO, and AI request handlers. — background.js:1
Calls AutoTDK traffic/Whois APIs and Google Analytics from panel features. — content/content.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or file-system capability. — manifest.json:22-54
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses remote responses as text or JSON feature data. — background.js:1
Loads packaged background and content scripts only. — manifest.json:26-54
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable section or MAIN-world script. — manifest.json:26-54
Uses chrome.runtime messaging without exposing a window message or CustomEvent listener. — content/content.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines and persists the packaged default setting object. — background.js:1
Reads the setting and ssrCheck values to choose UI behavior. — content/content.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Handles user-facing network and storage operations only. — background.js:1
Performs DOM analysis and UI rendering for SEO features. — content/content.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Removes textarea, input, and select nodes from the cloned document before reading text; no form action assignment appears. — content/content.js:1