Is SaveClip: I.G Downloader safe?
We analyzed SaveClip: I.G Downloader version 1.2's actual code and gave it a 82/100 trust score. This appears to be a purpose-aligned Instagram downloader…
Bottom line
This appears to be a purpose-aligned Instagram downloader with moderate page access, limited sharing of selected links, and minor unwanted behavior.
What it can access
The extension can inspect and change visible Instagram pages across matching Instagram hosts, which fits its downloader purpose. [Q1] It stores only a local checker setting and does not show access to passwords, cookies, browsing history, or device files. [Q4]
Security weaknesses
The extension automatically opens its associated website when installed, without a separate user request. [Q8] Its reviewed code has no demonstrated remote-code execution or privileged message interface, though bundled library code is harder to inspect. [Q7] [Q10]
Signs of misuse
The extension sends a selected Instagram link to its associated website after the user clicks a download control. [Q6] There is no evidence of password collection, broad browsing tracking, deception, remote commands, or other misuse. [Q12] [Q14] [Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension can inspect and modify Instagram pages and uses local storage, which fits its downloader purpose, but it can also share selected Instagram links with its associated website.
The extension declares storage access and runs its page features in all frames on *.instagram.com/*. — manifest.json:1
The extension reads visible Instagram page elements and URLs to add download controls, without collecting typed information. — js/content.js:4-187
A selected Instagram URL is sent to saveclip.app when the user activates a download control. — js/content.js:8-11
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Content scripts run directly on: *://*.instagram.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension can inspect and modify the Instagram DOM, but its complete source does not read form values, passwords, payment fields, messages, or other typed entries. It only reads URLs and visible page elements to place download buttons.
The content script runs in all frames on matching Instagram pages, giving it DOM access there. — manifest.json:23-35
The script reads the page URL, searches for selected DOM elements and text, observes DOM additions, and inserts buttons; it contains no input-value, password, payment, message, clipboard, or keystroke collection. — js/content.js:4-187
The bundled library is used by content.js for DOM operations and does not establish an additional sensitive-data collection path. — js/jquery.js:1-1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No code uses cookie, history, bookmark, download, or session-management APIs. The only declared permission is `storage`, used for a local checker flag.
The only declared permission is `storage`. — manifest.json:36-38
Storage is used only to get and set the local `checker` value. — js/content.js:156-177
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension opens saveclip.app. After a user clicks an inserted download control, it sends the current Instagram URL or a detected Instagram post URL in the q query parameter so the site can process the selected media; installation and toolbar clicks open only a fixed URL with a source marker.
openDownloadLink encodes its supplied Instagram link and places it in the q parameter of https://saveclip.app/en, with utm_source=extension. — js/content.js:8-11
The external navigation is attached to inserted download controls and occurs when the user clicks them. — js/content.js:21-23,50-52,71-73,103-105,136-139
Installation and toolbar-action handlers create tabs at the fixed saveclip.app URL with utm_source=extension and no page data. — js/background.js:1-11
Does it download or run code, settings, or instructions supplied by a remote server?
The extension source does not download or execute remote code, settings, or instructions. It navigates the browser to saveclip.app, but any scripts or downloader behavior delivered by that website are outside this extension and are not executed as extension code by the reviewed files.
The service worker only creates tabs for a fixed HTTPS website. — js/background.js:1-11
The content script only opens a remote web URL in a new tab after user interaction; it does not fetch, inject, eval, or execute returned code. — js/content.js:8-10,21-23,50-52,71-73,103-105,136-139
The extension-page CSP permits bundled scripts and does not provide a remote-code execution path. — manifest.json:44-47
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It opens saveclip.app automatically when the extension is installed, without a separate user click. A toolbar click also opens it, while Instagram download links open the site only after the user clicks an inserted control.
The onInstalled handler creates a new tab automatically at saveclip.app. — js/background.js:1-5
The toolbar action creates a new tab when the user clicks the extension action. — js/background.js:7-11
Content-script navigations are bound to clicks on generated download controls. — js/content.js:21-23,50-52,71-73,103-105,136-139
On matching Instagram pages, the script initializes and observes DOM changes automatically, but the observer only inserts controls and does not itself open the external site. — js/content.js:156-177
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The main extension code is readable, but the bundled jQuery library is very large and minified, making some library behavior harder to inspect. The extension’s own logic is not heavily obfuscated or dynamically generated.
The bundled jQuery is compressed into a very long minified line and includes generic script/AJAX mechanisms. — js/jquery.js:4
The extension-specific content script is readable and structurally straightforward. — js/content.js:1-188
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct `eval()`, `new Function()`, or string-based timer was found in the extension logic. The bundled jQuery contains a `globalEval` path for generic AJAX/script support, but the inspected code does not show the extension invoking it.
jQuery contains `globalEval` and script/AJAX support. — js/jquery.js:4
The content script uses a function callback with `setTimeout`, not a string timer; no direct eval construct is shown. — js/content.js:1-188
Does it track the websites, pages, searches, or links you visit?
The extension does not maintain a history, correlate visits, or transmit every page the user views. It does send an Instagram URL to saveclip.app when the user chooses a download, which is sharing the selected link for processing rather than evidence of general browsing tracking.
The script reads the current Instagram URL to decide where to place controls and passes it to the download handler for posts, stories, audio, and profiles. — js/content.js:40-45,67-73,95-105
On the feed it reads visible post links to attach download controls; it does not store, transmit, or correlate those links during scanning. — js/content.js:124-153
Only a link supplied to a user-activated download handler is sent to saveclip.app as q. — js/content.js:8-11
Storage is used only for a local checker flag controlling initialization; no browsing history or link log is stored. — js/content.js:156-179
Does it create a persistent ID or browser fingerprint to recognize you?
No persistent tracking ID or browser-fingerprinting logic was found. The only stored value is a simple checker flag.
Reads and sets chrome.storage.local key 'checker'; no identifier or fingerprint data is created. — js/content.js:157-160
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension does not visibly read cookies, session tokens, authentication data, or page contents for transmission. It sends Instagram URLs to saveclip.app when the user clicks a download button.
Opens saveclip.app with an encoded Instagram link in the q parameter. — js/content.js:8-10
Opens saveclip.app on installation or toolbar click; no cookie or page-data handling is shown. — js/background.js:1-10
Does it record typing, form entries, clipboard contents, or screenshots?
No typing, form-entry, clipboard, or screenshot capture was found. The content script observes DOM changes only to add download controls.
Uses MutationObserver to detect added DOM nodes and insert links; it does not record input or screenshots. — js/content.js:156-177
Can a website or remote server send commands that make the extension take actions?
No remote command channel or message listener was found. The extension performs actions only from installation, toolbar clicks, and user clicks on inserted download controls.
Only onInstalled and action.onClicked handlers are defined. — js/background.js:1-11
A user click opens the downloader with the selected Instagram URL. — js/content.js:22-24
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It adds download controls to Instagram pages and sends selected Instagram URLs to saveclip.app. It does not appear to alter referral codes, ads, carts, or search results.
Adds a download button to Instagram post areas. — js/content.js:19-35
Adds controls for posts, reels, stories, profiles, and feed items; it does not rewrite existing links or page results. — js/content.js:40-154
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No traffic interception, header modification, download interception, or proxy-setting code was found. It opens ordinary web tabs instead.
Uses chrome.tabs.create to open saveclip.app and does not use webRequest, declarativeNetRequest, proxy, or download APIs. — js/background.js:1-11
Can it communicate with software on the computer or services running on localhost?
No native-messaging connection, localhost request, or communication with computer software was found.
The manifest declares only the storage permission and no nativeMessaging permission. — manifest.json:1-40
No localhost or native-application communication is present. — js/background.js:1-11
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No hidden-data decoding, decryption, unpacking, dynamic code execution, or script injection was found. The content script creates visible HTML controls.
Constructs a download button and attaches a click handler. — js/content.js:19-23
Extension-page CSP permits only self-hosted scripts and objects. — manifest.json:31-34
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites are not given a messaging interface to privileged extension actions. The content script is restricted to Instagram pages, and no runtime message handlers are present.
Content scripts and web-accessible resources are limited to *.instagram.com/*. — manifest.json:18-29
No onMessage or externally connectable handler is defined. — js/background.js:1-11
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No date, user-targeting, or remote-settings activation logic was found. The script runs on Instagram pages and uses only a local checker flag.
Activation depends on being on Instagram and the local 'checker' value; no remote configuration or date checks appear. — js/content.js:156-179
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No hidden resource-intensive work or cryptocurrency-mining behavior was found. Its main recurring work is watching Instagram DOM changes.
MutationObserver schedules DOM scanning after added nodes; no mining, worker, or intensive computation is shown. — js/content.js:164-177
Does it change form fields or where a form sends its information?
It does not modify form fields or form destinations. It only inserts buttons that open saveclip.app with an encoded Instagram URL.
Builds a downloader URL from an Instagram link and opens it in a new tab. — js/content.js:8-10
Adds a button click handler rather than changing form elements or submission targets. — js/content.js:19-24