Is Twitter Video Slideshow safe?
We analyzed Twitter Video Slideshow version 3.0's actual code and gave it a 87/100 trust score. This is a purpose-aligned Twitter/X slideshow with limited…
Bottom line
This is a purpose-aligned Twitter/X slideshow with limited site access and no established data misuse.
What it can access
It can read and change Twitter/X pages to collect media, scroll, and support slideshow controls, which fits its stated purpose but still exposes page content. [Q1] [Q2]
Security weaknesses
The main weakness is that starting the feature allows automatic scrolling and page changes, though sensitive browser controls and outside commands are not exposed. [Q2] [Q8]
Signs of misuse
No evidence shows collection or sharing of personal data, tracking, traffic manipulation, or remote commands. [Q6] [Q14] [Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It asks only for website access on twitter.com and x.com, where its slideshow needs to find and control tweet media. It requests no named privileged browser permissions.
Limits both host access and its sole content script to https://twitter.com/* and https://x.com/*. — manifest.json:host_permissions and content_scripts
The named permissions array is empty; there is no tabs, cookies, history, downloads, or debugger permission. — manifest.json:permissions
Uses the granted site access to find tweet articles and their video or optional twimg media sources. — content.js:collectVideos/collectImages
Which websites can it run on, and can it read or change what appears on those pages?
It runs only on X/Twitter. After Start is clicked, it reads tweet media and status links, inserts a slideshow overlay, moves or recreates media in that overlay, scrolls the feed, and can click existing X social controls.
The content script is registered only for Twitter and X HTTPS pages. — manifest.json:content_scripts.matches
Collects article media and builds a fixed full-page player overlay. — content.js:collectMedia/createOverlayIfNeeded/loadCurrent
Scrolls the page to load more tweets and clicks like, repost confirmation, or bookmark controls after user action. — content.js:attemptToLoadMore/proxyClick
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
DOM queries target video, source, status-link, image, article, and social-control elements rather than form fields. — content.js:collectVideos/collectImages
Handles only slideshow navigation and playback keys while overlay is non-null. — content.js:keyHandler
No input-value, textarea-value, password-field, form-submit, or general typing collection occurs. — content.js:complete source review
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests none of the relevant browser permissions. — manifest.json:permissions
No document.cookie or private browser-data API is referenced. — content.js:complete source review
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
The permissions array is empty. — manifest.json:permissions
No device, clipboard, native messaging, file, capture, or extension-management API is used. — content.js/popup.js:complete source review
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Reuses the current page's media source or normalizes an existing twimg image URL for display. — content.js:getVideoSource/normalizeTwitterImageSrc
Contains no fetch, XHR, beacon, WebSocket, form submission, or extension server endpoint. — content.js/popup.js:complete network-sink review
Opens https://paypal.me/kurucowa only after an explicit Donate click. — popup.js:donate click handler
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All entry points refer to local packaged files. — manifest.json:action and content_scripts
Remote Twitter media URLs are assigned to video or image elements only. — content.js:resolveVideoSource/moveIntoOverlay
No configuration fetch, dynamic import, downloaded script, or response-to-code path exists. — content.js/popup.js:complete source review
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Starting the slideshow requires a popup-button click. Once started, it automatically observes the feed, scrolls to load more media, and advances through items as part of that requested slideshow.
Sends START_TWITTER_SLIDESHOW only when Start Overlay Slideshow is clicked. — popup.js:collect click handler
After start, automatically observes DOM additions and scrolls the feed for more media. — content.js:startWatchingForNewVideos/attemptToLoadMore
Calls proxyClick only from the matching overlay button's click listener. — content.js:social button listeners
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No proxy, management, privacy, settings, search, or homepage permission is requested. — manifest.json:permissions
No browser-settings API is called. — content.js/popup.js:complete source review
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable source implements the complete slideshow, scrolling, controls, social actions, and cleanup. — content.js:1-1638
Readable source implements the full popup behavior. — popup.js:1-78
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All setTimeout and setInterval uses pass function callbacks. — content.js:complete source review
Contains no dynamic-code primitive. — popup.js:complete source review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses /status/ links as temporary Set keys for deduplication. — content.js:makeVideoKey/makeImageKey
Clears media arrays and seen-key sets when the slideshow closes. — content.js:destroyOverlay
No page URL history or browsing event is persisted or transmitted. — content.js/popup.js:complete network/storage review
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
No random identifier generation, browser fingerprint fields, or identifying network request exists. — content.js/popup.js:complete source review
The only intended persisted values are the include-images toggle and image interval. — popup.js:saveImageOptions
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Keeps tweet references and media source strings in page memory and assigns them to local overlay elements. — content.js:media collection and display flow
No cookie access or outbound data sink is present. — content.js/popup.js:complete source review
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Responds only to Escape, ArrowLeft, ArrowRight, and Space while the overlay exists. — content.js:keyHandler
No clipboardRead, tabCapture, desktopCapture, or related permission is requested. — manifest.json:permissions
No screenshot API, canvas capture, key buffer, or form-value reader exists. — content.js:complete source review
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or web_accessible_resources entry is declared. — manifest.json:entire manifest
Accepts only START_TWITTER_SLIDESHOW on Chrome's internal extension messaging channel. — content.js:runtime.onMessage listener
No window message listener or server response handler forwards website data into privileged behavior. — content.js:complete event-listener review
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds fixed local markup and styles under a unique overlay ID. — content.js:createOverlayIfNeeded
No href, referral parameter, ad, cart, or search-result mutation occurs. — content.js:complete DOM-write review
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads, or proxy permission is requested. — manifest.json:permissions
Contains no corresponding API or redirect logic. — content.js/popup.js:complete source review
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or localhost access is declared. — manifest.json:permissions and host_permissions
No localhost or native endpoint is referenced. — content.js/popup.js:endpoint review
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All behavior is direct readable JavaScript and static local markup. — content.js/popup.js:complete source review
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable or web_accessible_resources surface is present. — manifest.json:entire manifest
Uses the isolated Chrome extension runtime channel and does not bridge page postMessage events. — content.js:runtime.onMessage listener
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
The only site condition is the plainly declared Twitter/X match list. — manifest.json:host_permissions and content_scripts
Behavior depends on user options, available media, navigation direction, and direct controls—not identity, dates, or remote configuration. — content.js:complete control-flow review
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Visible slideshow work consists of debounced media collection and UI state refresh. — content.js:startWatchingForNewVideos and social-status interval
Disconnects the mutation observer, clears timers and media state, and removes the overlay. — content.js:destroyOverlay/stopBackgroundLoading
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The only .value assignments target #tvso-volume created by the extension itself. — content.js:volume control handlers
Other value reads and writes target the extension popup's image-interval selector. — popup.js:image option handlers
No website input, textarea, form.action, submit control, or form event handler is modified. — content.js:complete DOM-write review