Is Blogging Helper Extension safe?
We analyzed Blogging Helper Extension version 1.0.0's actual code and gave it a 78/100 trust score. This is a mostly purpose-aligned SEO tool with broad…
Bottom line
This is a mostly purpose-aligned SEO tool with broad page access and one meaningful content-handling weakness.
What it can access
It can read SEO data and visible page text on every HTTPS site, broadly matching its research purpose but exceeding a narrowly on-demand design.[Q1]
Security weaknesses
A webpage can place misleading links or markup in the extension popup through copied page text when the user opens it.[Q21]
Signs of misuse
There is no evidence that it sends collected page data elsewhere, steals browser information, or accepts commands from websites.[Q6][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects a page access into every HTTPS page and requests activeTab. Broad page reading fits a competitor-SEO tool, but automatic all-HTTPS injection is more access than an on-click active-tab design would need.
Loads script.js on https://*/* and declares activeTab as its only named permission. — manifest.json:8-23
On a popup message, reads title, description, images, headings, links, visible body text, canonical URL, and robots metadata. — script.js:1-64
Which websites can it run on, and can it read or change what appears on those pages?
It can read and technically modify content on every HTTPS website. The implemented behavior is read-only SEO analysis except for briefly creating a local download link when the user exports image data.
The content-script match pattern covers every HTTPS page. — manifest.json:8-12
Reads SEO metadata and visible page text when the popup requests a report. — script.js:1-64
Creates and clicks a temporary blob download link only for a user-requested CSV export. — script.js:194-225
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Because its page access runs throughout each HTTPS page, it has the technical ability to inspect sensitive form fields. The actual code reads SEO metadata, headings, images, links, and visible body text; it does not select inputs, passwords, payment fields, or typed messages.
Runs extension code with DOM access on every HTTPS website. — manifest.json:8-12
The complete readers target page text and SEO elements, with no form-control or credential selector. — script.js:1-64,75-191,228-310
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
permissions array contains only "activeTab"; no storage, cookies, history, or bookmarks permission — manifest.json:1-15
No chrome.cookies, chrome.history, chrome.bookmarks, chrome.downloads, or chrome.storage calls — script.js:1-310
No persistence or private-data API calls found — popup.js:1-291
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Returns the SEO result through chrome.runtime messaging to the popup. — script.js:47-64
Displays the returned data locally and contains no upload request. — popup.js:13-226
Loads only a presentation stylesheet from cdnjs; scripts are packaged locally. — popup.html:6-11
Does it download or run code, settings, or instructions supplied by a remote server?
The popup downloads a remote Font Awesome stylesheet from cdnjs, so that server can influence styling and referenced assets. It does not download or execute remote JavaScript, settings, or behavioral instructions.
References a Font Awesome CSS file at cdnjs.cloudflare.com. — popup.html:6-11
All executable scripts are local files bundled in the extension. — popup.html:462-464
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Analysis triggers only when popup is opened (user clicks extension icon) — popup.js:13-17
CSV export requires explicit button click — popup.js:229-244
fetchRobotsTagHeader() called with no argument — a bug, but does not open pages or redirect — popup.js:164
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Extension-owned content-script code is unobfuscated and fully readable — script.js:1-310
Extension-owned popup code is unobfuscated and fully readable — popup.js:1-291
Minified but standard jQuery; extension code only uses .html(), .text(), .val(), and event binding — jquery.min.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
No eval, new Function, or string-based timer calls — script.js:1-310
No eval, new Function, or string-based timer calls — popup.js:1-291
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No storage, history, or tabs permission; no background worker to persist data — manifest.json:1-15
No chrome.storage, localStorage, IndexedDB, or network transmission of visited-page records — script.js:1-310
No persistence or tracking calls; data lives only in popup DOM until closed — popup.js:1-291
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Only activeTab is declared; no storage, tabs, or background entries exist. — manifest.json:1-15
No chrome.storage, localStorage, IndexedDB, or ID-generation calls found. — script.js:1-310
No persistence or fingerprinting API calls in popup code. — popup.js:1-291
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Collected data is serialized and sent via sendResponse to the popup only. — script.js:1-64
Popup renders received data into its own DOM; no outbound data POST or fetch with page payload. — popup.js:13-226
External Font Awesome CSS load carries no page data. — popup.html:6-9
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Copy button writes formatted headings to clipboard via execCommand('copy'); no clipboard read. — popup.js:246-284
No keydown/keyup listeners, form interception, or canvas/screenshot APIs. — script.js:1-310
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry or background service worker. — manifest.json:1-24
Responds only to chrome.runtime messages from extension contexts. — script.js:1-74
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
All DOM operations are read-only (textContent, getAttribute, querySelector). — script.js:1-64
Generated robots.txt/sitemap.xml links are informational anchors, not modifications to page links. — popup.js:166-169
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Permissions list contains only activeTab; no webRequest, proxy, or downloads entries. — manifest.json:1-15
fetchRobotsTagHeader reads a response header but does not modify outgoing requests. — popup.js:145-164
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
fetchRobotsTagHeader(url) is called with no argument; no localhost or 127.0.0.1 target. — popup.js:145-164
No nativeMessaging or externalConnectable declarations. — manifest.json:1-15
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Straightforward DOM queries, calculations, and CSV construction; no obfuscation or dynamic execution. — script.js:1-310
Direct jQuery/DOM manipulation; no eval, new Function, or atob-then-execute patterns. — popup.js:1-291
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Copies page-controlled heading text verbatim into the report. — script.js:75-104
Interpolates that text into an HTML string and passes it to jQuery .html() without escaping. — popup.js:175-204
No custom relaxed CSP is declared, limiting injected inline handlers or scripts under the MV3 default policy. — manifest.json:1-24
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Content script matches https://*/* with no per-site or per-user conditions. — manifest.json:5-10
Message handler executes the same analysis regardless of page, user, or date. — script.js:1-64
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Reading-ease calculation is a simple syllable/word count; no sustained CPU work. — script.js:100-192
No Worker, SharedWorker, or long-running async loops. — popup.js:1-291
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No form element manipulation, no submit-event listeners, no action-attribute changes. — script.js:1-310
Popup renders data into its own fields; no code targets page forms. — popup.js:1-291