Is TobyFlow - Auto Flow, Auto ChatGPT, Auto Grok & AI Workflow Automation safe?
We analyzed TobyFlow - Auto Flow, Auto ChatGPT, Auto Grok & AI Workflow Automation version 1.3.29's actual code and gave it a 52/100 trust score. This is…
Bottom line
This is a powerful AI automation extension with broad access, remote workflow control, and notable data-sharing concerns.
What it can access
It can modify supported AI pages, capture selected regions, download media, and operate across nearly every website, exceeding its core feature needs. [Q1][Q2][Q5]
Security weaknesses
The developer website can remotely start workflows and use privileged media and tab functions, while page bridges lack a strong message secret. [Q16][Q21]
Signs of misuse
It automatically sends usage and device identifiers, and its service can receive selected authenticated media and workflow data, though these are partly tied to the advertised service. [Q6][Q8][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site host access plus tabs, scripting, downloads, unlimited storage, side panel, notifications, context menus, clipboard write and response-header modification. The AI automation and image-to-prompt features explain much of this scope, but the resulting access is extensive.
Declares <all_urls>, many named AI/social/media hosts, tabs, scripting, downloads, declarativeNetRequestWithHostAccess and clipboardWrite. — manifest.json:1-142
Installs persistent automation on supported AI sites and an image-to-prompt content script on nearly every HTTP(S) page. — manifest.json:143-214
Which websites can it run on, and can it read or change what appears on those pages?
It reads and changes Google Flow, ChatGPT, Gemini, Grok and Muse pages to enter prompts, upload references, select settings, click generation controls and inspect generated results. On other sites, the all-page helper only acts when asked to capture a selected image or region.
Coordinates prompt insertion, reference upload, generation settings, submission, result collection and downloads. — src/core/EditorExecutor.js:1
Sends commands to provider content scripts to edit composers, submit jobs and retrieve media. — src/core/MessageBridge.js:1
The all-site helper records a context-menu position and opens capture/analyze UI only after an extension message or explicit region selection. — i2p-content.js:18-737
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It writes user or saved-workflow prompts into AI input fields and can submit them. Those prompts could contain sensitive text, but I found no listener that passively captures unrelated passwords, payment fields or ordinary typing.
Breaks workflow prompts into segments, inserts text and mentions into the provider editor, verifies the result and submits it. — src/core/EditorExecutor.js:1
Main-world bridge focuses Google Flow's editor and supports controlled file insertion/submission for the extension workflow. — slate-bridge.js:1
Contains no input/change/password listener; its key listener handles Escape for the extension overlay. — i2p-content.js:18-737
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can inspect tabs and manage downloads, and it operates inside logged-in AI pages. It has no cookies, history or bookmarks permission, but its developer-site bridge can fetch protected media with the browser's existing AI-service session.
Declares tabs and downloads but not cookies, history or bookmarks. — manifest.json:1-142
External fetchMedia accepts allowlisted AI media URLs and fetches them with credentials:'include' before returning base64 to labs.toby.vn. — background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can capture a user-selected screen region, fetch selected images, store large local media/workflow data, write text to the clipboard and save downloads. It does not request camera, microphone, location, native messaging or broad local-file access.
User region selection leads to captureVisibleTab through the background and crops the selected pixels. — i2p-content.js:632-737
Declares unlimitedStorage, downloads and clipboardWrite; camera, microphone, geolocation, nativeMessaging and file-scheme access are absent. — manifest.json:1-142
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends enrollment, account, feature, session, usage and workflow-status data to labs.toby.vn. Prompts/reference media go to the selected AI provider, and the developer website can receive allowlisted authenticated media that it explicitly asks the extension to fetch.
Enrolls a persistent device fingerprint with labs.toby.vn, signs API calls and services external fetchMedia/listFlowLibrary requests. — background.js:1
Posts session heartbeats, anonymous fingerprint, daily feature counts and bounded event metadata to Toby's usage endpoints. — src/core/UsageSync.js:1-183
Reports workflow ID/name, node progress, status and error summary to Toby's execution endpoints. — src/core/WorkflowExecutor.js:53-63
Does it download or run code, settings, or instructions supplied by a remote server?
Toby servers supply page selectors, provider URLs, services schemas, models, execution settings, feature gates, templates and watermark-removal configurations that materially direct automation. These are treated as structured data; no downloaded JavaScript execution was found.
Downloads and caches provider selectors, public API configs and authenticated private provider configs. — src/core/ProviderConfigManager.js:1
Fetches public system settings that govern timeouts and feature behavior. — src/core/SystemConfig.js:1
Fetches private Flow protocol/model/schema/runtime and watermark-removal configuration from labs.toby.vn. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Normal automation follows a user-created task or workflow, but labs.toby.vn can start a saved workflow or node without a fresh extension confirmation. Enrollment, usage heartbeats and telemetry also run automatically.
The onMessageExternal runWorkflow/runNode path validates the Toby origin, then opens a run window and accepts the job without a per-run approval step. — background.js:1
Starts a session heartbeat on initialization and periodically flushes usage events. — src/core/UsageSync.js:1-183
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no chrome_url_overrides, search provider, proxy, privacy, management or debugger capability. — manifest.json:1-142
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Most first-party files retain readable names and logic, but the extension is large and heavily bundled into one-line files, with sizable workflow, media and third-party components. This makes complete manual review harder without being evidence of abuse by itself.
Records about 10 MB unpacked and many large JavaScript modules, including workflow editors, media processing and the bundled mediabunny library. — inventory.json:1-1244
A large one-line service worker combines enrollment, configuration, page automation, media handling and external messaging. — background.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Extension CSP allows scripts only from self and does not allow unsafe-eval. — manifest.json:1-142
The only focused dynamic-code scan hit was reEvalProvider naming, not JavaScript eval(). — src/prompts/GenTab.js:33
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Does not report location.href or navigation; it handles selected images, regions and its own local history. — i2p-content.js:18-737
Its declared telemetry schemas contain feature/provider/count/status fields, not browser URLs or page titles. — src/core/UsageSync.js:1-183
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent random device fingerprint for server enrollment and a separate persistent anonymous analytics fingerprint, along with session IDs. These identify an installation over time even when the user is not logged in.
Creates toby_device_fp, sends it to /enroll and stores the returned long-lived client enrollment. — background.js:1
Creates af_fingerprint and includes it with anonymous heartbeats/events; also persists an active session UUID. — src/core/UsageSync.js:35-75
Does it send cookies, session details, authentication data, or page contents elsewhere?
Prompts and selected images are sent into the chosen logged-in AI service as the feature requires. The Toby website can also obtain protected generated-media bytes through the extension's credentialed fetch bridge, but I found no code that sends raw provider cookies, passwords or authorization headers to Toby.
External fetchMedia fetches up to 12 HTTPS URLs from a strict Google/OpenAI/xAI media-host allowlist with credentials and returns data URLs to labs.toby.vn. — background.js:1
Passes workflow prompt text and selected reference media to provider tabs and uploads generated media into Google Flow. — src/core/MessageBridge.js:1
Remote telemetry sanitizer explicitly redacts prompt, cookie, token, authorization and request/response-body keys. — src/core/flow-api/FlowApiTelemetry.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
It edits AI text/composer fields, uploads selected references, captures a user-selected page region and can write output text to the clipboard. These actions are central to the product; it does not continuously monitor typing, forms or clipboard contents.
Inserts prompts and media into provider composers and submits generation jobs. — src/core/EditorExecutor.js:1
Copies generated prompt text only on a button click and captures only a region the user drags. — i2p-content.js:551-737
Temporarily traps a Flow file picker to insert a specific extension-provided File during an automation action. — slate-bridge.js:1
Can a website or remote server send commands that make the extension take actions?
The developer website can command privileged extension behavior. After validating the exact HTTPS Toby host, the external listener can start/stop workflows, run a node, inspect AI tabs and Flow projects, enumerate or download media and upload content into Flow.
Declares labs.toby.vn as externally_connectable. — manifest.json:1-142
onMessageExternal exposes runWorkflow, runNode, providerStatus, currentProject, listFlowLibrary, fetchMedia, resolveFlowApiMedia, downloadWorkflowMedia and uploadToFlow after a strict origin check. — background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Reads a ref value on labs.toby.vn and forwards it to the extension affiliate storage path. — ref-bridge.js:1
Stores validated external preview refCode as tf_ref for 90 days; no host-page link mutation path was found. — background.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It manages generated downloads and removes Cross-Origin-Resource-Policy from matching Google Flow media responses so the extension can read/process them. It does not configure a general proxy or intercept arbitrary browsing traffic.
Removes the cross-origin-resource-policy response header for flow.google.com/asb/ image, media and XHR requests. — rules/flow-media-headers.json:1-27
Uses chrome.downloads for generated media and can rename/monitor extension-initiated downloads. — background.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared; reviewed fixed destinations are public Toby and AI-provider services. — manifest.json:1-142
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote configurations are parsed as bounded structured data; code injection uses fixed packaged file names. — background.js:1
Extension CSP restricts executable scripts to packaged self resources. — manifest.json:1-142
Can ordinary websites access privileged extension features through messaging or exposed files?
labs.toby.vn can directly use a broad privileged runtime-message interface, including authenticated media fetch and workflow execution. Main-world Flow/Gemini bridges also accept same-window messages without a secret nonce, but those page-local bridges mostly process media or editor actions the host page can already observe.
External message listener grants the validated developer site a large set of privileged capabilities and returns data to it. — background.js:1
MAIN-world listener accepts TOBY_MEDIA_INTERCEPT_CONFIG/RESULT/DOWNLOAD_CONTEXT messages from window without a cryptographic nonce. — media-interceptor.js:1
MAIN-world listener checks e.source and message source/action, with an additional random submit token for privileged V2 submit targeting. — slate-bridge.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Gates features on authenticated user/plan entitlements and cached server state. — src/core/FeatureGate.js:1-7
Server authorization can disable the extension or a banned device, but no hidden victim-specific malicious payload path was identified. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Processes video frames to remove configured watermarks. — src/core/VideoWatermarkRemover.js:1
Runs batch generation, media resolution, upscaling, watermark processing and downloads across workflow items. — src/core/EditorExecutor.js:1
Large packaged media-processing library supports local media work rather than mining. — vendor/mediabunny.js:1
Does it change form fields or where a form sends its information?
It intentionally changes AI-site input/contenteditable controls, file inputs, settings and submit buttons to run generations. I found no code that rewrites a form action to a third-party collection server or alters unrelated forms on ordinary sites.
Inserts prompt segments, selects provider options, uploads files and activates submission as the core automation. — src/core/EditorExecutor.js:1
Sets a selected File on Google Flow's file input and invokes the intended submit control during an armed workflow operation. — slate-bridge.js:1
The all-site helper adds an isolated overlay but does not modify host form actions or values. — i2p-content.js:18-737