Is SolasLite - Communication Analysis safe?
We analyzed SolasLite - Communication Analysis version 1.0.11's actual code and gave it a 60/100 trust score. SolasLite is purpose-aligned but deserves…
Bottom line
SolasLite is purpose-aligned but deserves caution because it handles private writing, sends it to its provider, and has an unsafe login-message check.
What it can access
It can read private drafts and selected text on email and professional-networking sites for analysis, then send that content to Solas [Q1][Q3][Q6].
Security weaknesses
A webpage can supply login details without proving where the message came from, and remote text is placed into the page unsafely [Q16][Q22].
Signs of misuse
The provider-sharing supports its stated feature, but full login details are logged and sent with submitted writing, creating a serious privacy concern [Q6][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, activeTab, scripting, context menus, storage, Solas services access, and persistent page access on major email and professional-network sites.
Declares activeTab, contextMenus, storage, tabs, scripting, solas-os.ai host access, and content scripts for Gmail, Outlook, and LinkedIn. — manifest.json:8-42
Creates an Analyze context-menu item for selected text on any HTTP or HTTPS page. — background.js:23-72
Which websites can it run on, and can it read or change what appears on those pages?
It runs automatically on Gmail, Outlook, and LinkedIn and can inject analysis buttons and modal overlays; an explicit context-menu click can inject the same UI on other active pages.
Loads content and styles on the listed communication sites. — manifest.json:21-42
Uses activeTab and scripting to insert packaged CSS and JavaScript after the user invokes the selection context menu elsewhere. — background.js:811-901
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read private email-draft text or any deliberately selected webpage text and send it for analysis; it does not automatically read passwords, payment fields, inbox history, or unrelated form values.
The Gmail button click reads composeArea.innerText or textContent and starts analysis. — content.js:133-144
The context-menu action receives info.selectionText only after an explicit user selection and click. — background.js:51-65
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests none of cookies, history, bookmarks, or downloads. — manifest.json:8-16
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It stores submitted recent text and its Solas session locally, but has no files, location, camera, microphone, clipboard-read, screen-capture, or native-application access.
Stores up to five recent entries containing full submitted text, context, average score, and timestamp in chrome.storage.local. — shared-recent-analysis.js:31-67
Only local extension storage is requested among device-like data capabilities. — manifest.json:8-16
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the user-submitted or selected communication text, a random request ID, and Solas authentication and CSRF tokens to solas-os.ai for analysis.
Builds the analysis body from response:text and request_id. — background.js:309-324
POSTs selected text to /lite/comms_checker with session and CSRF authentication. — background.js:544-584
Uses the same request body for a Gmail draft initiated by its compose button. — background.js:436-484
Does it download or run code, settings, or instructions supplied by a remote server?
The server streams sentiment, emotion, clarity, trait, and AI-explanation data that the extension renders, but it does not deliver executable JavaScript.
Parses server-sent events as JSON and forwards the resulting data to extension UI code. — background.js:638-772
Maps fixed status values to analysis data and accordion updates. — streaming-accordion-handler.js:24-176
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
The mutation observer adds UI; the click handler performs the actual compose-text read and analysis request. — content.js:69-188
Selection analysis begins from a context-menu click. — background.js:51-65
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings overrides, proxy, privacy, management, debugger, or search-provider capability. — manifest.json:1-68
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Security-relevant authentication, API, injection, and response logic is formatted and descriptively named. — background.js:1-1081
Records 287,783 unpacked bytes, including a 64 KB unused test archive. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads the local packaged configuration using importScripts('config.js'). — background.js:1-10
Remote stream content is JSON-parsed as data rather than evaluated. — background.js:638-772
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads and logs the selected tab's URL and title locally during context-menu analysis. — background.js:241-245
The outbound analysis body contains only response text and request_id. — background.js:544-584
Does it create a persistent ID or browser fingerprint to recognize you?
The Solas account session persistently identifies the user for up to eight hours; per-analysis UUIDs are fresh request identifiers rather than a tracking fingerprint.
Stores solas_session_token and an eight-hour expiration in chrome.storage.local. — background.js:193-226
Creates a new crypto.randomUUID for each analysis request. — background.js:1011-1021
Does it send cookies, session details, authentication data, or page contents elsewhere?
Private submitted text and Solas authentication data go to solas-os.ai. The login callback also writes the session token to diagnostic logs.
Receives sessionToken through postMessage or a DOM data attribute and logs the full token before forwarding it. — background.js:144-179
Sends communication text with session and CSRF credentials to the Solas analysis API. — background.js:544-584
Does it record typing, form entries, clipboard contents, or screenshots?
It reads a complete Gmail draft on an Analyze-button click and reads explicitly selected text elsewhere; it does not keylog, monitor every input event, read clipboard contents, or capture screenshots.
Reads the current compose area's visible text only inside the injected button click handler. — content.js:133-144
Uses Chrome-provided selectionText for the explicit selection context menu. — background.js:51-65
Can a website or remote server send commands that make the extension take actions?
Solas responses control displayed analysis content, and the auth callback accepts a token-bearing window message without checking event.origin; there is no general external extension-message services.
The injected callback listener tests message type and token presence but never validates event.origin or event.source. — background.js:144-179
Remote SSE fields drive the analysis modal and its content. — streaming-accordion-handler.js:24-176
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Host-page changes add an analysis button and modal near Gmail's composer rather than rewriting page commerce or links. — content.js:133-180
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads, or proxy permission. — manifest.json:8-16
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
CURRENT_ENV selects the HTTPS production Solas endpoint; localhost is only a dormant development configuration. — config.js:11-23
Grants only solas-os.ai host access and no nativeMessaging. — manifest.json:8-16
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
SSE bytes are decoded as UTF-8 and JSON-parsed into fixed application data paths, not code. — background.js:638-772
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes UI resources on all URLs but declares no externally_connectable entry. — manifest.json:52-66
Uses internal runtime messaging from packaged extension contexts and content scripts. — background.js:77-120
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Interpolates the remote AI explanation excerpt and report ID directly into content.innerHTML. — shared-accordion.js:277-299
Interpolates a remote error message into innerHTML. — streaming-accordion-handler.js:198-217
Interpolates server-provided usage message and upgrade URL into a modal's innerHTML. — content.js:675-700
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is authentication, context-menu handling, page UI injection, and user-requested streaming analysis. — background.js:1-1081
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The Gmail integration creates a type=button analysis control beside Send and explicitly prevents default submission. — content.js:133-180
Reads and analyzes the draft without assigning to the composer or submitting it. — content.js:190-224