Is Student Stars safe?
We analyzed Student Stars version 0.0.3's actual code and gave it a 78/100 trust score. Student Stars appears feature-aligned but asks for unnecessarily…
Bottom line
Student Stars appears feature-aligned but asks for unnecessarily broad access to HTTPS webpages.
What it can access
It can run across every HTTPS webpage, although its observed feature only displays rewards and stores student records locally.[Q1]
Security weaknesses
Broad webpage access increases exposure, but no meaningful misuse or dangerous browser-control weakness was found.[Q1][Q8][Q9][Q21]
Signs of misuse
No evidence shows data leaving the browser, tracking, remote commands, or deceptive changes to webpages.[Q6][Q12][Q16][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It injects a page access on all pages and declares access to every HTTPS site, although its observed feature only needs to display an overlay.
Declares content_scripts matches <all_urls> and host_permissions https://*/*. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
It modifies each active page only by rendering a temporary reward overlay; no page-content reading was found.
Custom component listens for star, message, and feeling fields from chrome.runtime messaging and renders a three-second modal. — content.1d473d26.js:40
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It handles user-entered student names, notes, photos, and reward totals inside its popup, not from webpage forms.
Student editor creates records with name, resized photo, note, and star fields. — popup.5eb990aa.js:40
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
Student records are persisted in chrome.storage.local and can be explicitly imported or exported as CSV.
Reads and writes the students array in local extension storage and implements user-triggered CSV import/export. — popup.5eb990aa.js:40,54
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read a user-selected profile image or CSV file and download a user-requested CSV export.
Creates visible file inputs for images and CSV imports and a blob download for exports. — popup.5eb990aa.js:40,54
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Custom data flow uses local storage, FileReader, and local CSV blobs; no application fetch or upload exists. — popup.5eb990aa.js:40,54
The content component only displays internally supplied reward data. — content.1d473d26.js:40
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Application state is packaged or stored locally. — popup.5eb990aa.js:40,54
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Star changes are bound to user clicks and then messaged to the active tab. — popup.5eb990aa.js:40
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests only storage and unlimitedStorage. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains identifiable third-party libraries and readable application strings. — popup.5eb990aa.js:1-54
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Bundled code contains no dynamic-code execution sink. — content.1d473d26.js:1-40
Bundled popup contains no dynamic-code execution sink. — popup.5eb990aa.js:1-54
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Queries the active tab and uses only its id for chrome.tabs.sendMessage. — popup.5eb990aa.js:40
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Only student records and UI state are stored. — popup.5eb990aa.js:40,54
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission and the content script does not read page inputs. — manifest.json:3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Custom content logic only renders the reward modal from internal messages. — content.1d473d26.js:40
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable origins or network service. — manifest.json:3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Renders a modal with star total, praise text, and animation for three seconds. — content.1d473d26.js:40
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no network-control or downloads permissions. — manifest.json:3
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission or localhost access. — manifest.json:3
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads only the packaged popup bundle and stylesheet. — popup.html:1-12
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable bridge. — manifest.json:3
Popup sends fixed reward fields to the active tab. — popup.5eb990aa.js:40
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
All application actions are bound to visible popup controls. — popup.5eb990aa.js:40,54
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runtime work is limited to the bundled UI and short reward animation. — content.1d473d26.js:1-40
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Custom content logic inserts its own overlay and does not query or edit existing forms. — content.1d473d26.js:40