Is MagicSchool AI - AI Assistant for Teachers safe?
We analyzed MagicSchool AI - AI Assistant for Teachers version 2.4.3's actual code and gave it a 68/100 trust score. This is a legitimate-looking teacher…
Bottom line
This is a legitimate-looking teacher tool with broad website access and a notable content-rendering weakness, but no established abuse.
What it can access
It runs on every website and requests cookie access, although reviewed use is mainly a MagicSchool overlay and MagicSchool sign-in. [Q1][Q2][Q4]
Security weaknesses
Remote-generated text is inserted as HTML without sanitizing, so unsafe content could affect the extension interface. [Q7][Q10]
Signs of misuse
Prompts and results go to MagicSchool for its AI features, while reviewed checks found no tracking of visited sites or browser-session theft. [Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests activeTab, scripting, cookies, identity, storage, tabs and all-URL host access, and injects a page access on every website. The all-page overlay and authentication explain part of this access, but the cookie and arbitrary-host network capability are broader than the fixed MagicSchool flows observed in code.
Declares activeTab, scripting, cookies, identity, storage, tabs, <all_urls> host access and an all-URLs content script. — manifest.json:12-38
Observed API and authentication callers target app.magicschool.ai and auth.magicschool.ai rather than arbitrary sites. — assets/main.ts-PhoDNmad.js:1,14
Which websites can it run on, and can it read or change what appears on those pages?
It runs on every URL and appends a fixed MagicSchool button plus panels inside a closed shadow root. The interface can cover page content, but the reviewed code does not read or rewrite the host page's text, links or forms.
Registers the loader and stylesheet for <all_urls>. — manifest.json:26-37
Creates #crx-root, attaches a closed shadow root and renders the MagicSchool UI; Yg suppresses it when the hostname is in disabledSites. — assets/main.tsx-D8mlinZd.js:216
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Um and Ig bind input handlers only to MagicSchool's own prompt/tool fields and call generation APIs from Enter or Generate actions. — assets/main.tsx-D8mlinZd.js:87
The extension UI is isolated in its own shadow root; no listener reads host-page input, change or submit events. — assets/main.tsx-D8mlinZd.js:216
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The cookie permission technically allows broad cookie access, but the reviewed code only sets and maintains Supabase authentication cookies for .magicschool.ai and stores its own access/refresh session in Chrome sync storage. It does not query other-site cookies, history, bookmarks or downloads.
Requests cookies and all-URL host access but not history, bookmarks or downloads. — manifest.json:12-24
Supabase cookie adapter calls chrome.cookies.set with the fixed MagicSchool auth URL/domain and stores MSAuthCookies/MSAuthSession in chrome.storage.sync. — assets/main.ts-PhoDNmad.js:14
Defines the fixed app, auth and .magicschool.ai destinations. — assets/environment-_DffQKTl.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A visible Copy button writes generated text to the clipboard. It does not read existing clipboard contents and has no location, camera, microphone, native-messaging or general file-system permission.
The output panel calls navigator.clipboard.writeText only from its Copy button. — assets/main.tsx-D8mlinZd.js:216
No clipboardRead, geolocation, camera, microphone, nativeMessaging or file-system permission is declared. — manifest.json:12-18
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
User-entered prompts and tool fields are POSTed to MagicSchool generation services after Generate/Enter. The same inputs and AI output are then stored in MagicSchool assistant-thread services.
ym and km send tool inputs or commands to app.magicschool.ai generation endpoints; vm sends tool_inputs and tool_output to assistant thread endpoints. — assets/main.tsx-D8mlinZd.js:87
The service worker sends email/password or OAuth authentication through auth.magicschool.ai and posts named analytics events through the MagicSchool app API. — assets/main.ts-PhoDNmad.js:1,14
The stylesheet loaded on all matched pages imports Poppins from fonts.googleapis.com. — assets/main-BKgA1ZIV.css:1
Does it download or run code, settings, or instructions supplied by a remote server?
MagicSchool supplies tool definitions and AI-generated response text. The response is converted from Markdown to HTML and inserted into the page overlay without a separate sanitizer.
Generation requests receive a streamed response body and store it as currentGeneration. — assets/main.tsx-D8mlinZd.js:87
Ug passes the server text to Showdown makeHtml and Wg renders the result with dangerouslySetInnerHTML without a sanitizer call. — assets/main.tsx-D8mlinZd.js:216
The only dynamically imported application module is a fixed chrome.runtime.getURL packaged file. — assets/main.tsx-loader-B-SVYAYd.js:1-13
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Installation opens the fixed MagicSchool website and injects the page access into already-open tabs. Normal generation, copying, login and navigation require visible user actions.
onInstalled injects the declared script into existing matched tabs and opens http://www.magicschool.ai/ on first install. — assets/main.ts-PhoDNmad.js:14
Generate, Copy, login and tool navigation are bound to extension UI controls. — assets/main.tsx-D8mlinZd.js:87,216
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
The permissions list omits browser-setting, proxy, search and extension-management APIs. — manifest.json:12-18
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application bundles are heavily minified and no source maps are included, making first-party and library code harder to separate. Important services services and the generation-to-HTML path remain directly inspectable.
Lists minified JavaScript bundles but no .map files. — inventory.json:1
Despite minification, the fixed generation calls, response state, Markdown conversion and HTML sink are present in clear code. — assets/main.tsx-D8mlinZd.js:87,216
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Imports assets/main.tsx-D8mlinZd.js through chrome.runtime.getURL with a literal packaged path. — assets/main.tsx-loader-B-SVYAYd.js:4-10
Manual fixed-string searches across all packaged JavaScript found no eval( or new Function occurrence. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
The popup reads only the active tab hostname to toggle disabledSites and does not transmit it. — assets/index.html-wF9MJEc3.js:1
window.location is used for a Google Forms input workaround and per-host disabling, not included in generation or analytics requests. — assets/main.tsx-D8mlinZd.js:87,216
All-page CSS imports a third-party Google Fonts stylesheet; live referrer behavior was not captured. — assets/main-BKgA1ZIV.css:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores MSAuthSession and auth cookies and posts eventType/eventProperties to the fixed MagicSchool API; no generated analytics identifier is present. — assets/main.ts-PhoDNmad.js:1,14
Does it send cookies, session details, authentication data, or page contents elsewhere?
Email/password, OAuth refresh tokens and Supabase session tokens are sent only to MagicSchool's fixed authentication service and stored for that account; this is normal authentication rather than demonstrated credential theft. Prompts, tool inputs and AI outputs go to MagicSchool's generation/history services.
Defines fixed app.magicschool.ai, auth.magicschool.ai and .magicschool.ai destinations. — assets/environment-_DffQKTl.js:1
Supabase sign-in and OAuth flows handle the user's MagicSchool session; cookie writes are scoped to the MagicSchool domain. — assets/main.ts-PhoDNmad.js:14
Generation and assistant-thread APIs receive user-entered inputs and generated output, not scraped page contents. — assets/main.tsx-D8mlinZd.js:87
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
onKeyDown/onChange handlers are attached to MagicSchool UI fields inside the shadow root. — assets/main.tsx-D8mlinZd.js:87
navigator.clipboard.writeText is called only by the output panel's Copy action. — assets/main.tsx-D8mlinZd.js:216
No clipboardRead, desktopCapture or tabCapture permission is declared. — manifest.json:12-18
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
yo stores the streamed generation response body as currentGeneration. — assets/main.tsx-D8mlinZd.js:87
Wg converts currentGeneration with Showdown and supplies it to dangerouslySetInnerHTML without a sanitizer. — assets/main.tsx-D8mlinZd.js:216
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates a separate #crx-root closed shadow tree and renders fixed MagicSchool controls there. — assets/main.tsx-D8mlinZd.js:216
Generated HTML is confined to the output component's shadow-root container in the reviewed source. — assets/main.tsx-D8mlinZd.js:216
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
authFetch accepts message.url and message.options without an origin allowlist and forces credentials:'include'. — assets/main.ts-PhoDNmad.js:1
Every reviewed dt caller builds its URL from the fixed app.magicschool.ai base. — assets/main.tsx-D8mlinZd.js:87
Has all-URL host access but no webRequest, declarativeNetRequest, downloads or proxy permission. — manifest.json:12-24
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
nativeMessaging is absent and no localhost-specific host permission is declared. — manifest.json:12-24
Defines public HTTPS MagicSchool service endpoints. — assets/environment-_DffQKTl.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Base64/URL helpers support authentication and realtime libraries; their output does not reach eval or a script injector. — assets/main.ts-PhoDNmad.js:1-14
The generation path uses Markdown-to-HTML conversion and an HTML sink rather than decoding an opaque executable payload. — assets/main.tsx-D8mlinZd.js:216
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Lists web-accessible assets but no externally_connectable entry. — manifest.json:39-66
Imports the fixed packaged main.tsx bundle through chrome.runtime.getURL. — assets/main.tsx-loader-B-SVYAYd.js:4-10
No first-party window MessageEvent listener forwards page data into chrome.runtime messaging. — assets/main.tsx-D8mlinZd.js:87-216
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Popup toggles the active hostname in disabledSites. — assets/index.html-wF9MJEc3.js:1
Yg hides the overlay on disabled hosts; qi/Da apply only on docs.google.com/forms and only update MagicSchool control state. — assets/main.tsx-D8mlinZd.js:87,216
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Bundled timers and websocket helpers belong to Supabase authentication/realtime libraries; no hashing/mining loop or worker pool is present. — assets/main.ts-PhoDNmad.js:1-14
Generation endpoints are called from visible command/tool actions. — assets/main.tsx-D8mlinZd.js:87
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
qi and Da are attached to MagicSchool TextField onKeyDown handlers and update extension React state. — assets/main.tsx-D8mlinZd.js:87
The extension UI is created under its own closed shadow root; no host form mutation path appears in the initialization code. — assets/main.tsx-D8mlinZd.js:216