Is DesignAssets - Extract Any Website's Design safe?
We analyzed DesignAssets - Extract Any Website's Design version 1.0.0's actual code and gave it a 65/100 trust score. This is a purpose-aligned design…
Bottom line
This is a purpose-aligned design tool, but its all-site visibility and saved page snapshots make it a fairly powerful extension.
What it can access
It can inspect visible design data on every website and save page snapshots locally, which is broad but fits its stated purpose.[Q1][Q2][Q4]
Security weaknesses
Automatic extraction on every site and local storage of complete snapshots could expose more page information than users expect.[Q8][Q4]
Signs of misuse
The review found no outside sharing, credential collection, typing capture, or remote commands.[Q6][Q14][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has persistent content-script access to every regular website plus scripting, storage, side-panel, alarm, and active-tab permissions.
Declares <all_urls> host access and a document-idle content script on all URLs. — manifest.json:8-17,40-52
Which websites can it run on, and can it read or change what appears on those pages?
It reads page structure and computed presentation data, media references, inline SVG markup, page identity, and limited element text for accessibility results.
Walks page elements to collect colors, typography, spacing, effects, images, SVGs, video, audio, and related metadata. — content/extractor.js:17-1139
Accessibility checks collect selectors, roles, ARIA labels, and up to 50 characters of element text. — content/extractor.js:1183-1603
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Accessibility checks can retain short visible text from links, buttons, headings, and other inspected elements, but input values and message bodies are not read.
getElementInfo records element text, selector, role, and ARIA label; form checks inspect labeling rather than input value. — content/extractor.js:1183-1603
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores settings, usage counters, and up to 20 complete extracted page snapshots locally; it does not request cookies or browser history.
Writes state.history, including each page URL and extracted data, to chrome.storage.local and caps it at 20 entries. — popup/app.js:154-163,1870-1883
Requests storage but not cookies or history. — manifest.json:8-17
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can copy design values and download individual or zipped page assets after user actions.
Fetches selected media/SVG resources for ZIP export, writes clipboard text, and creates local downloads. — popup/app.js:2190-2405,2419-2531
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Only relays extension messages and manages local defaults and usage resets. — background/service-worker.js:1-95
The only fetch calls retrieve asset URLs already extracted from the page for a user-requested local export. — popup/app.js:2190-2405
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses packaged behavior and local storage only. — background/service-worker.js:1-95
Contains no configuration API or server response controlling extension behavior. — popup/app.js:1-2665
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The page access loads on every website, and opening the side panel automatically extracts the active page without a second confirmation.
Runs content/extractor.js at document_idle on <all_urls>. — manifest.json:40-52
DOMContentLoaded calls extractPageData automatically after initializing the side panel. — popup/app.js:74-93
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests none of the permissions used for those settings. — manifest.json:8-17
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The bundled JSZip dependency is minified, but the extension's own extraction and UI code is readable; minification alone is not evidence of abuse.
Contains the minified JSZip 3.10.1 library. — utils/jszip.min.js:1-13
Main extraction logic is readable and documented. — content/extractor.js:1-1823
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
A setImmediate polyfill can compile a non-function callback with new Function; extension calls use normal functions and packaged JSZip operations. — utils/jszip.min.js:13
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
EXTRACT_ALL includes window.location.href and document.title. — content/extractor.js:1746-1770
Adds the analyzed page URL and snapshot to a local history capped at 20 entries. — popup/app.js:1870-1883
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no tracking or network code. — background/service-worker.js:1-95
Contains no analytics endpoint or generated user identifier. — popup/app.js:1-2665
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request cookies or identity permissions. — manifest.json:8-17
Form inspection checks accessible labels but never reads input values. — content/extractor.js:1183-1603
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Inspector mode listens for mouse movement, click, and Escape solely to select an element and return its styles. — content/extractor.js:618-740
Form checks inspect labels and element metadata, not current values. — content/extractor.js:1296-1314
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Only accepts packaged internal message types and stores inspector results. — background/service-worker.js:1-95
Handles a fixed list of extension messages. — content/extractor.js:1746-1822
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds removable overlay and tooltip elements and changes the body cursor while inspector mode is active. — content/extractor.js:616-740
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
User-requested bulk export fetches media and SVG URLs found on the analyzed page; no proxying or traffic interception exists.
Fetches extracted asset URLs, packages successful responses with JSZip, and downloads the archive locally. — popup/app.js:2190-2295,2332-2405
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or system-level permission. — manifest.json:8-17
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetch responses are placed into ZIP files or SVG exports and never evaluated as code. — popup/app.js:2190-2405
Extension behavior is a fixed packaged message handler. — content/extractor.js:1746-1822
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry and exposes only static assets. — manifest.json:36-63
Listens with chrome.runtime.onMessage rather than window messaging. — content/extractor.js:1746-1822
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Side-panel initialization requests EXTRACT_ALL for the active page. — popup/app.js:74-93,166-218
Bulk asset fetching begins only from export handlers. — popup/app.js:2190-2405
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Compute-heavy loops perform the advertised page inspection after an extraction request. — content/extractor.js:17-1822
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Form logic reads label-related attributes only and records no value or action property. — content/extractor.js:1296-1314,1552-1573