Is AI Mind Maps Maker - AI Create Mind Map safe?
We analyzed AI Mind Maps Maker - AI Create Mind Map version 5.5's actual code and gave it a 74/100 trust score. This is a mostly purpose-aligned extension…
Bottom line
This is a mostly purpose-aligned extension with moderate access and a notable risk from sending selected text and URLs to its service.
What it can access
It can use tab URLs, selected text, and HTTPS PDF pages for mind-map features, which broadly fits its purpose but exposes user-provided data.[Q1][Q2][Q3][Q6]
Security weaknesses
User text and page addresses are inserted into web links without safe encoding, which can disclose URL details or change how data is read.[Q6]
Signs of misuse
The extension sends selected text and page addresses to its service after visible user actions, with no evidence of hidden tracking or unrelated collection.[Q6][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs to read the current page URL and contextMenus to accept selected text or a page action. Those permissions match its web-to-mind-map launcher behavior.
Declares tabs and contextMenus. — manifest.json:9-12
Creates selection and page context-menu actions and uses the selected text or page URL. — background.js:19-47
Reads the active tab URL for the visible Web Content action. — popup.js:56-61
Which websites can it run on, and can it read or change what appears on those pages?
On HTTPS URLs ending in .pdf it adds a floating mind-map link. It does not inspect or alter the PDF contents.
Runs contentScript.js only on https://*/*.pdf. — manifest.json:13-23
Creates a styled anchor and image whose destination contains the current PDF URL. — contentScript.js:30-61
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It receives text the user has highlighted through Chrome's context-menu services and sends that text to livepolls.app. It does not independently read password or payment fields.
The selection menu copies info.selectionText into the livepolls.app destination. — background.js:19-24, 32-47
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Only tabs and contextMenus are privileged permissions. — manifest.json:9-12
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No device, file, clipboard or management permission is declared. — manifest.json:1-39
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends selected text, active page URLs or PDF URLs to livepolls.app for mind-map creation. The values are placed directly in a query string without URL encoding, so sensitive URL tokens may be disclosed and separators can alter parsing.
Constructs a livepolls.app URL directly from selected text or pageUrl and opens it. — background.js:1-7, 32-47
Places the active tab URL directly into the Web_Page destination. — popup.js:56-61
Places the current PDF URL and filename directly into the floating link. — contentScript.js:50-60
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Parses recommendation JSON into select options that open only when the user changes the selection. — popup.js:3-43
Uses only the packaged background service worker. — manifest.json:24-27
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Navigation occurs only inside the contextMenus.onClicked handler. — background.js:32-47
All mind-map navigation is attached to visible click handlers. — popup.js:49-61
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No settings-changing permission or override is declared. — manifest.json:1-39
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Complete background logic is readable source. — background.js:1-48
Complete PDF integration is readable source with commented development remnants. — contentScript.js:1-62
Complete popup logic is readable source. — popup.js:1-62
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No dynamic execution primitive is used. — background.js:1-48
Remote JSON is rendered as text and URLs, not executed. — popup.js:1-62
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Page URL use is limited to a context-menu click. — background.js:32-47
Active URL use is limited to clicking Web Content To Mindmap. — popup.js:56-61
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
No identifier generation or persistent storage is used. — background.js:1-48
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends user-selected page text and current URLs to livepolls.app after explicit actions. It does not read cookies, sessions or arbitrary page bodies.
Sends info.selectionText or info.pageUrl in the mind-map URL. — background.js:32-47
No cookies permission exists and content-script scope is limited to PDF URLs. — manifest.json:9-23
Does it record typing, form entries, clipboard contents, or screenshots?
It can transmit text the user explicitly selected, but does not monitor typing, inspect forms, read the clipboard or capture screenshots.
The visible selection action forwards Chrome-provided selectionText. — background.js:19-24, 38-47
No clipboard or capture permission is declared. — manifest.json:9-12
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Recommendation data is used for option text and destinations; navigation needs a change event. — popup.js:3-43
No network listener or remote command polling exists. — background.js:1-48
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Downloads recommendation JSON from imgkits.com and appends its products to the More Apps select. — popup.js:3-43
Presents the recommendations in a visible More Apps control. — popup.html:149-153
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No proxy, webRequest, declarativeNetRequest or downloads permission is declared. — manifest.json:9-12
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
127.0.0.1 alternatives are commented out and cannot execute. — popup.js:49-60
No nativeMessaging permission is declared. — manifest.json:9-12
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Only constructs URLs and opens tabs. — background.js:1-48
Parses ordinary recommendation JSON without hidden payload handling. — popup.js:1-62
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Active logic only inserts an anchor; runtime messaging code is commented out. — contentScript.js:1-62
No externally_connectable or web_accessible_resources section exists. — manifest.json:1-39
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Behavior depends only on installation, browser family and explicit context-menu actions. — background.js:1-48
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
PDF-page behavior creates one link and exits. — contentScript.js:30-62
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates a new anchor and image without locating or modifying forms. — contentScript.js:30-61