Is Excel Formula Generator safe?
We analyzed Excel Formula Generator version 1.0.1's actual code and gave it a 78/100 trust score. This appears purpose-aligned, but user prompts leave the…
Bottom line
This appears purpose-aligned, but user prompts leave the browser and the paywall can direct limited extension actions.
What it can access
Access is limited to the extension panel, local storage, and tumutuk.com, but submitted prompts are sent to that service.[Q1][Q6][Q15]
Security weaknesses
The paywall can request navigation and access-tier changes, and its messages lack an explicit website-origin check.[Q16]
Signs of misuse
No clear evidence shows tracking, account-data collection, or manipulation of ordinary websites; its data transfer supports the stated formula feature.[Q6][Q12][Q14][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests local storage, side-panel access and HTTPS access only to tumutuk.com. Those permissions match its settings, paywall and formula service.
Declares storage and sidePanel plus host access limited to tumutuk.com and www.tumutuk.com. — manifest.json:1-47
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No content_scripts, scripting permission, tabs permission or broad host access is declared. — manifest.json:1-47
The formula UI loads as an extension-owned side-panel page. — src/popup/index.html:1-13
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No website content-script capability is present. — manifest.json:1-47
The only input is a 700-character textarea inside the extension panel. — assets/main-D0ozagH4.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
No cookies, history, bookmarks, downloads or webRequest permission is declared. — manifest.json:1-47
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Only storage and sidePanel permissions are requested. — manifest.json:1-47
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the user's entered text, generate/explain action and Excel/Sheets choice to tumutuk.com. The data is placed in a GET query string, which may be retained in server or network logs.
Builds URLSearchParams containing llmActionType, input and formulaType, then GETs https://tumutuk.com/api/v1/generate-formula?... and displays the text response. — assets/main-D0ozagH4.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It loads a remote tumutuk.com paywall page that can send display styles, a redirect URL and a tier value to the extension UI. This is remote UI/configuration, not downloaded JavaScript execution in the extension origin.
Creates an iframe from https://www.tumutuk.com/app/excel and handles change-styles, redirect and set-tier messages from that frame. — assets/formula-type-selector-DuXXCb0j.js:1
Formula responses are consumed as plain text and displayed in a read-only textarea. — assets/main-D0ozagH4.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On install it automatically opens a welcome page and configures an uninstall survey URL. Eligible users also load the hidden remote paywall when the extension UI opens.
On first install opens tumutuk.github.io/excel, records install date and sets a tumutuk.github.io uninstall URL. — assets/background.ts-D2QBq4Hx.js:1
gg.init automatically creates the paywall iframe for eligible local tier/date state. — assets/formula-type-selector-DuXXCb0j.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
setPanelBehavior enables openPanelOnActionClick; no browser preference is changed. — assets/background.ts-D2QBq4Hx.js:1
No settings-related permission is declared. — manifest.json:1-47
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The React UI and dependencies are compiled/minified, but the small application flow, services, stored fields and browser services remain traceable. No deliberate obfuscation was found.
A 228 KB compiled bundle contains React, UI components, validation and the paywall logic. — assets/formula-type-selector-DuXXCb0j.js:1-37
A 56 KB compiled bundle contains the complete panel and request flow. — assets/main-D0ozagH4.js:1-6
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All five executable JavaScript bundles were checked for dynamic-code primitives. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, webNavigation, webRequest or content-script access is present. — manifest.json:1-47
The sole application API request occurs after the Generate/Explain button is clicked. — assets/main-D0ozagH4.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It does not create a stable random tracking ID. The paywall receives local installation date and action count, which can still help segment or recognize a user session.
Stores installDate, userActions, paywallTier and formula settings in chrome.storage.local; no generated client identifier is stored. — assets/storage-functions-C_waw6F4.js:1
Adds actions and optional install date query parameters to the paywall iframe URL. — assets/formula-type-selector-DuXXCb0j.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or website content access is declared. — manifest.json:1-47
Does it record typing, form entries, clipboard contents, or screenshots?
Text entered in the extension's own prompt box is transmitted only after the user presses Generate or Explain. It does not monitor website typing, clipboard data or screenshots.
The controlled textarea updates local state; the click handler sends that state to the mutation function. — assets/main-D0ozagH4.js:1
No content-script, clipboard or capture capability is declared. — manifest.json:1-47
Can a website or remote server send commands that make the extension take actions?
The remote paywall page can tell the extension to resize/show its frame, open a supplied URL or set the local access tier. Source-window validation confines those commands to the loaded paywall frame, though no explicit origin check is present.
The message listener requires i.source === iframe.contentWindow, then handles change-styles, redirectUrl and tier data. — assets/formula-type-selector-DuXXCb0j.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Embeds the tumutuk Excel product page as a paywall and supports portal/redirect navigation. — assets/formula-type-selector-DuXXCb0j.js:1
No ordinary-site execution access exists. — manifest.json:1-47
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is declared. — manifest.json:1-47
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Host access is limited to two tumutuk HTTPS patterns and nativeMessaging is absent. — manifest.json:1-47
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Reads the API response with response.text() and assigns it to a read-only textarea value. — assets/main-D0ozagH4.js:1
Remote paywall content is loaded as an HTTPS iframe rather than injected into extension script execution. — assets/formula-type-selector-DuXXCb0j.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
web_accessible_resources exposes only four PNG icons and two SVG logos; externally_connectable is absent. — manifest.json:25-42
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Paywall initialization checks the local tier and its last-update time before embedding the product page. — assets/formula-type-selector-DuXXCb0j.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The worker only handles installation and side-panel behavior. — assets/background.ts-D2QBq4Hx.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script or website execution permission exists. — manifest.json:1-47