Is Screen capture and recorder - Screenshot Tool safe?
We analyzed Screen capture and recorder - Screenshot Tool version 1.0.8's actual code and gave it a 52/100 trust score. This is a purpose-aligned recorder…
Bottom line
This is a purpose-aligned recorder with unusually broad access and unsafe handling of shared captures and sign-in data.
What it can access
It runs on every website and can capture visible content, screens, cameras, and microphones, which fits its recorder purpose but creates broad exposure [Q1][Q3][Q5].
Security weaknesses
The extension prints a Google sign-in credential to its developer console, creating a concrete exposure risk if that console is accessible [Q14].
Signs of misuse
Chosen Drive sharing makes recordings publicly readable, while the sign-in credential is also logged; this shows unsafe handling but not proven covert collection [Q6][Q14].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, all-URL and active-tab access, storage with no quota, alarms, desktopCapture, and identity, and injects on every website. These permissions are broad but support its advertised screenshots, full-page capture, recording controls, and Google Drive sharing.
Declares capture, identity, tab, storage, alarms, all-URL permissions and an all-sites content script. — manifest.json:24-50
Which websites can it run on, and can it read or change what appears on those pages?
Its page access runs on every website and can insert crop overlays, countdowns, webcam bubbles, access prompts, and recording/drawing controls. Full-page capture scrolls the document and temporarily hides or restores fixed elements.
Packaged source maps show all-site UI injection, page scrolling, fixed-element adjustment, cropping, and recording controls. — js/content.js.map:extension/content/content.ts and actions sources
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Screenshots and recordings can visibly capture passwords, messages, payment information, documents, and any other content shown in the selected tab, window, or screen. The code captures pixels/media rather than directly reading form values.
Uses chrome.tabs.captureVisibleTab for visible, full-page-piece, and crop captures. — js/background.js.map:captureVisibleAction.ts, doPieceOfCaptureAction.ts, captureAndCropAction.ts
Records selected desktop/tab/camera media streams. — js/index.js.map:RecordingPage and WebcamRecordingPage sources
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads active tab IDs, titles, URLs/status changes, and window IDs to manage capture and recording. It stores per-tab state but does not request cookies, history, bookmarks, or downloads services.
Queries active tabs, watches tab updates/removals, uses titles for capture names, and maintains tab state. — js/background.js.map:serviceWorker.ts and capture action sources
No cookies, history, bookmarks, or downloads permission. — manifest.json:24-34
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can access a user-selected screen, window, or tab plus camera, microphone, and optional tab/system audio. Chrome's chooser and media permission flows gate access.
Uses desktopCapture.chooseDesktopMedia and getUserMedia for selected display, camera, microphone, and optional audio tracks. — js/index.js.map:RecordingPage.tsx, WebcamRecordingPage.tsx, captureMicrophone.ts
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Only when the user chooses Google Drive upload, it sends the complete screenshot/video and file name directly to Google Drive. It then grants 'anyone' reader permission and retrieves a share link.
Uploads multipart media to googleapis.com, POSTs role reader/type anyone permission, and requests webViewLink. — js/background.js.map:uploadToGoogleDriveAction.ts
Does it download or run code, settings, or instructions supplied by a remote server?
Google OAuth and Drive responses supply the access token, uploaded file ID, permission result, and share URL used by fixed packaged logic. It does not download remote JavaScript, plug-ins, capture instructions, or executable settings.
Parses fixed OAuth and Drive response fields and stores the resulting link. — js/background.js.map:uploadToGoogleDriveAction.ts
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On first install it automatically opens capturecast.net. During recording it updates badge/time state and restores/removes injected controls as tabs change.
Install opens the website; alarms and tab listeners maintain an active user-started recording. — js/background.js.map:serviceWorker.ts, startDesktopRecordingAction.ts
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No proxy, privacy, management, declarativeNetRequest, or browser-settings permission. — manifest.json:24-34
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The three runtime bundles are large and minified, but complete source maps include original TypeScript/React application sources, making important behavior substantially easier to inspect. Much of the 43.5 MB unpacked size is source maps and animated image assets rather than hidden code.
Records multi-megabyte minified bundles, source maps, and GIF assets. — inventory.json:complete file
Embed original source names and sourcesContent for application and dependencies. — js/background.js.map, js/content.js.map, js/index.js.map:complete files
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Dynamic constructor matches contain only fixed global-object lookup strings from packaged libraries/runtime. — js/background.js, js/content.js, js/index.js:bundled runtimes
Extension-page CSP permits self scripts only. — manifest.json:95-97
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
tabs.onUpdated receives status/url and clears local per-tab state; tabs.onRemoved deletes state and stops related recording UI. — js/background.js.map:serviceWorker.ts
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Storage keys cover captures, records, tabs, preferences, and recording state rather than a tracking identifier. — js/background.js.map, js/index.js.map:application sources
Does it send cookies, session details, authentication data, or page contents elsewhere?
The Google OAuth access token is sent as a Bearer token only to Google Drive services, but the complete OAuth callback URL containing that token is also printed to the extension developer console. Uploaded captures are made link-public.
Logs responseUrl, extracts access_token, uses it for Google upload/permission/link requests, and grants type:anyone reader access. — js/background.js.map:uploadToGoogleDriveAction.ts
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture screenshots and record screen/window/tab pixels, webcam, microphone, and optional tab audio. It can therefore record sensitive visual and spoken content after user initiation and browser permission.
Uses visible-tab capture, desktopCapture, camera/microphone getUserMedia, MediaRecorder, and optional mixed audio. — js/background.js.map, js/index.js.map:capture and recording application sources
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Runtime listener dispatches fixed internal action names. — js/background.js.map:serviceWorker.ts
No externally_connectable declaration. — manifest.json:1-97
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Injected components are cropper, countdown, webcam, permission prompt, and recording editor/control UI. — js/content.js.map:extension/content actions
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:24-34
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
desktopCapture is declared; nativeMessaging and local service hosts are absent. — manifest.json:24-34
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Data transformations produce canvas images, PDF/media blobs, storage records, and Google upload bodies only. — js/background.js.map, js/content.js.map:capture and upload sources
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes index.html and media/font resources to all URLs. — manifest.json:76-84
Privileged actions use internal runtime listeners without a window postMessage bridge. — js/content.js.map, js/background.js.map:content.ts and serviceWorker.ts
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches follow capture/recording preferences and UI state. — js/background.js.map, js/content.js.map, js/index.js.map:application sources
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Captures every viewport piece at full quality, retains temporary data URLs, and composites the final canvas. — js/content.js.map, js/background.js.map:startTakingScreenshotAction.ts, checkIsScreenshotDoneAction.ts, doPieceOfCaptureAction.ts
Requests unlimitedStorage for locally retained captures. — manifest.json:24-34
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
DOM changes mount isolated capture/recording components and adjust scrolling/fixed visibility only. — js/content.js.map:extension/content and app/Content sources