Is Post5s: 5-Second AI Content Creator safe?
We analyzed Post5s: 5-Second AI Content Creator version 2.0.0's actual code and gave it a 85/100 trust score. This is a purpose-aligned AI writing…
Bottom line
This is a purpose-aligned AI writing extension with moderate page and data access, but no established abuse or serious security weakness.
What it can access
It requests temporary page access and uses selected text, images, and page addresses for Google-based generation, matching its stated purpose.[Q1][Q2][Q6]
Security weaknesses
No meaningful weakness was found: actions require user requests, code execution is restricted, and ordinary websites lack privileged control.[Q7][Q8][Q11][Q21]
Signs of misuse
No evidence shows tracking, persistent identification, link manipulation, hidden activation, or misuse beyond requested content generation.[Q12][Q13][Q17][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can temporarily access the active tab, inject its result UI, and use selected page or image context after a user action. It has no persistent all-sites page access.
Requests activeTab, scripting, tabs, storage, context menus, clipboard writing, and notifications. — manifest.json:6-18
Injects the packaged UI handler into the selected tab when needed. — background.js:26-80
Which websites can it run on, and can it read or change what appears on those pages?
It receives selected text, an image URL, and the active page URL from Chrome's context-menu event, then adds a generated-content overlay to that page.
Uses info.selectionText, info.srcUrl, and tab.url only in user-invoked generation handlers. — background.js:147-175,262-294
Adds the generated text modal to the page. — ui-handler.js:222-315
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Highlighted text can be sent for generation, but only when the user invokes the Website command on that selection. It does not read arbitrary inputs or messages.
Registers the command for page or selection context and passes Chrome-provided selected text to generation. — background.js:18-23,147-175
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores user-provided Gemini services keys, settings, generated content, and local donation-click history in extension storage. No cookies, browsing history, bookmarks, or saved passwords are accessed.
Loads and stores Gemini API key records locally. — gemini-api.js:15-43,55-103
Keeps donation click events only in chrome.storage.local. — popup.js:551-579
Requests storage but not cookies or history. — manifest.json:6-18
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It downloads the image explicitly chosen from the context menu and can copy generated text to the clipboard. No camera, microphone, screenshot, or arbitrary file access was found.
Fetches and base64-encodes the context-menu image. — background.js:262-294,378-388
Copies generated textarea content after the user clicks Copy. — ui-handler.js:257-288
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends selected text, page URLs, or selected image bytes to Google's Gemini services with the user's services key. This is required for and consistent with its advertised AI-generation feature.
POSTs image data and page context to generativelanguage.googleapis.com. — gemini-api.js:498-534
POSTs page URL and selected text in a generation prompt to the same host. — gemini-api.js:937-956,1016-1046
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses a fixed Google API base URL and model. — gemini-api.js:5-12
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Generation is reached only from context-menu click handlers. — background.js:7-24,147-175,262-294
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-settings or override capability. — manifest.json:1-42
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains named, documented event and UI functions. — background.js:1-80
Contains readable API and storage logic. — gemini-api.js:1-43
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Extension CSP permits only packaged scripts. — manifest.json:27-29
Uses fixed script injection and function callbacks, not text-to-code execution. — background.js:1-400
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Passes tab.url for the selected website or image action. — background.js:170-175,288-294
Requests tabs but not history. — manifest.json:6-18
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores donation-click timestamps locally without a network send. — popup.js:551-579
Does it send cookies, session details, authentication data, or page contents elsewhere?
It handles user-supplied Gemini services keys. They are stored locally and sent in request URLs only to Google's fixed Gemini services; no unintended recipient was found.
Stores keys locally and tests them at generativelanguage.googleapis.com. — gemini-api.js:15-43,159-183
Uses the key only in Google Gemini request URLs. — gemini-api.js:498-534,1016-1046
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Uses info.selectionText from the explicit context-menu event. — background.js:147-175
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Extracts generated response text and performs formatting only. — gemini-api.js:1048-1076
Places generated output in a read-only textarea value. — ui-handler.js:257-261
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Requests loading and generated-content UI actions. — background.js:164-189
Constructs and inserts the result modal. — ui-handler.js:222-315
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:6-18
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission. — manifest.json:1-42
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Restricts extension-page scripts to self. — manifest.json:27-29
Injects only the packaged ui-handler.js file. — background.js:26-80
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Invokes a fixed page function with a fixed action and supplied display data. — background.js:53-79
Defines page UI functions without a window-message listener. — ui-handler.js:1-315
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Loads local post settings. — background.js:82-103
Lets the user change and save those generation settings. — popup.js:331-363
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Contains context-menu, API, storage, and UI orchestration only. — background.js:1-400
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Creates an extension-owned, read-only textarea for generated output. — ui-handler.js:257-261