Is AItsy – AI customer support assistant for Etsy sellers safe?
We analyzed AItsy – AI customer support assistant for Etsy sellers version 1.0.5's actual code and gave it a 68/100 trust score. AItsy is purpose-aligned,…
Bottom line
AItsy is purpose-aligned, but its access to private Etsy messages and account-related data creates meaningful privacy risk.
What it can access
It runs across Etsy domains but mainly reads message pages, inserts drafts, and sends conversation data to its service, which fits its purpose but exposes private messages [Q1][Q2][Q3][Q6].
Security weaknesses
The extension logs a callback address containing a Google sign-in credential, creating a risk if diagnostic logs are exposed [Q14].
Signs of misuse
No clear hostile misuse is established, but the service receives private conversations and a persistent trial ID for account recognition [Q6][Q13].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and Google identity, runs content code on Etsy, and can contact the ShopsHelper services; these permissions fit an Etsy AI-reply service.
Declares a service worker, storage and identity permissions, api.shopshelper.com host access, Google profile scopes, and content scripts on Etsy domains. — manifest.json:12-35
Loads the packaged assistant, authentication, settings, conversation, and UI modules at document_end. — manifest.json:36-70
Which websites can it run on, and can it read or change what appears on those pages?
Its code is injected across Etsy domains, but it mounts the assistant only on www.etsy.com message pages, where it can read the conversation and edit the reply composer.
Content scripts match etsy.com and all Etsy subdomains. — manifest.json:30-70
isMessagesArea requires the exact www.etsy.com origin and /messages path before mounting the assistant. — src/content.js:2264-2319
Reads visible conversation content and can insert a returned suggestion into a textarea, input, or contenteditable composer. — src/shared.js:566-635
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads private Etsy customer messages and participant names for AI drafting, but it excludes input, textarea and button elements and does not collect passwords or payment fields.
Collects the last eight visible non-system messages, buyer and seller names, product title, and listing URL while explicitly excluding textarea, input, and button nodes. — src/shared.js:566-616
Places the collected conversation into the JSON request sent when generating a draft. — src/sidebar/host/prompt-behavior.js:447-477
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Only storage and identity are requested; cookies, history, bookmarks, downloads, and tabs are absent. — manifest.json:15-28
Conversation context comes from visible Etsy DOM text rather than cookie or session APIs. — src/shared.js:566-616
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the file, geolocation, clipboard, capture, media, management, or nativeMessaging capabilities. — manifest.json:15-28
Clipboard is used only as a fallback destination to copy the generated suggestion when composer insertion fails; clipboard contents are never read. — src/sidebar/host/prompt-behavior.js:607-624
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends recent Etsy messages, customer and seller names, product details, drafting preferences, account identifiers, and authentication data to services.shopshelper.com.
Builds conversation context from recent messages, product title and URL, buyer name, and seller name. — src/shared.js:593-616
POSTs conversation context, tone, language, UI language, and optional instructions to /draft-replies. — src/sidebar/host/prompt-behavior.js:447-477
Adds the account bearer token and persistent trial ID to API requests. — src/sidebar/auth/controller.js:277-285
Does it download or run code, settings, or instructions supplied by a remote server?
The backend supplies generated replies, account settings, quota state, subscription data, and seller-authored snippets, but none of those responses are executed as code.
Parses the draft response and quota fields as JSON before presenting or inserting the suggestion. — src/sidebar/host/prompt-behavior.js:473-510
Loads user, subscription, and settings from /me and applies them as application state. — src/sidebar/auth/panel.js:1850-1874
Fetches account FAQ categories and snippets for the assistant's rules interface. — src/sidebar/ui/faq-manager.js:1970-1976
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Generation validates quota, gathers the current conversation, and sends it from the direct-generation action. — src/sidebar/host/prompt-behavior.js:410-477
A successful response is inserted into the composer; no send or submit action follows. — src/sidebar/host/prompt-behavior.js:592-630
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings overrides, proxy, privacy, management, debugger, or search-provider capability. — manifest.json:1-76
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Records 734,726 unpacked bytes split across named source, UI, authentication, environment, and localization files. — inventory.json:1
The core data-upload and composer-insertion flow is formatted, plainly named, and directly traceable. — src/sidebar/host/prompt-behavior.js:410-630
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses fixed packaged fetch, OAuth, native-development, and message-dispatch functions without dynamic execution. — src/background.js:1-221
Remote bodies are parsed as text or JSON and never passed to an execution primitive. — src/sidebar/core/transport.js:131-178
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads the current message thread and first matching Etsy listing link from the visible message page. — src/shared.js:566-616
Content-script scope is confined to Etsy domains rather than all websites. — manifest.json:30-35
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent random trial ID and also recognizes signed-in users through Google identity and ShopsHelper account tokens.
Generates a UUID-like trial ID, stores it in localStorage, and includes it as X-ESB-Trial-ID on API requests. — src/sidebar/auth/controller.js:232-285
Persists access token, refresh token, user, subscription, and settings in chrome.storage.local. — src/sidebar/auth/controller.js:141-190
Does it send cookies, session details, authentication data, or page contents elsewhere?
Private message contents and account authentication data go to ShopsHelper. The extension also logs the Google OAuth callback URL containing the ID token to its service-worker console.
Sends the Etsy conversation object and reply preferences to /draft-replies. — src/sidebar/host/prompt-behavior.js:447-477
Sends the Google ID token to /auth/google and stores the returned session. — src/sidebar/auth/panel.js:1888-1912
Logs responseUrl before extracting id_token; the fragment-bearing callback URL therefore appears in extension diagnostic output. — src/background.js:159-182
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads visible completed message elements while explicitly excluding textarea, input, and button nodes. — src/shared.js:572-603
Requests no clipboardRead, capture, camera, microphone, or desktopCapture permission. — manifest.json:15-28
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry and exposes no web-accessible resources. — manifest.json:1-76
Listens only to internal chrome.runtime messages and has no WebSocket, push, or external-message listener. — src/background.js:192-221
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The only host-page content mutation in the core flow is writing a generated draft into the Etsy message composer. — src/shared.js:624-635
Adds only the AItsy assistant interface on Etsy message pages. — src/content.js:2296-2319
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads, or proxy permission. — manifest.json:15-28
The internal API proxy makes ordinary fetch calls and returns their result; it does not hook browser traffic. — src/background.js:20-34
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Contains code to ping localhost:8000 and call com.shopshelper.backend through sendNativeMessage. — src/background.js:37-97
Does not grant nativeMessaging or localhost host access; its only persistent host is api.shopshelper.com. — manifest.json:15-21
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote data is retained as response text or parsed JSON for application use. — src/sidebar/core/transport.js:131-178
Draft and quota fields are consumed as data, not code. — src/sidebar/host/prompt-behavior.js:490-590
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares neither externally_connectable nor web_accessible_resources. — manifest.json:1-76
Uses chrome.runtime.onMessage for extension-internal API and sign-in requests only. — src/background.js:192-221
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Membership and quota state gate the advertised reply-generation action. — src/sidebar/host/prompt-behavior.js:410-477
Remote settings are merged into application state and persisted without any executable-code path. — src/sidebar/auth/controller.js:335-359
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is limited to API proxying, account sign-in, and unreachable local-development startup helpers. — src/background.js:1-221
The packaged code contains UI, localization, authentication, and drafting modules rather than mining or proxy libraries. — inventory.json:1
Does it change form fields or where a form sends its information?
It writes an AI-generated reply into Etsy's message field, but it does not submit the form or change where the message is sent.
Sets textarea or input value, or inserts text into a contenteditable composer, then dispatches only an input event. — src/shared.js:624-635
applySuggestion inserts or copies the draft and stops; it never clicks Send, submits a form, or rewrites a form action. — src/sidebar/host/prompt-behavior.js:592-630