Is SchoolAI: AI for Schools. Teacher Tools, Student Spaces. safe?
We analyzed SchoolAI: AI for Schools. Teacher Tools, Student Spaces. version 2.0.6's actual code and gave it a 62/100 trust score. Powerful,…
Bottom line
Powerful, purpose-related access is present, but broad webpage visibility and handling of educational, account, visual, file, and audio data make this a higher-risk extension.
What it can access
It runs on every normal webpage and requests school-service, file, screenshot, and audio capabilities for its tools.[Q1][Q2][Q5][Q6]
Security weaknesses
Broad page visibility can expose sensitive content, and not every webpage-to-extension command path was fully verified.[Q3][Q16]
Signs of misuse
No clear misuse is established, but feature-triggered data sharing and default persistent analytics recognition reduce privacy.[Q6][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests broad page, tab, navigation, script-injection, background-recording, storage, alarm, and power-management capabilities. Most are explainable by its advertised teaching, document, screenshot, and notetaker features, but the resulting access is still extensive.
Requests tabs, activeTab, scripting, webNavigation, offscreen, power and related permissions, with an optional all-sites host grant. — manifest.json:permissions, host_permissions, optional_host_permissions
Loads its main content script on every HTTP and HTTPS webpage. — manifest.json:content_scripts
Registers handlers for documents, screenshots, file processing, OAuth, chat, analytics, LMS feedback, and audio recording. — src/entrypoints/background/index.ts:180-430
Which websites can it run on, and can it read or change what appears on those pages?
Its main interface code runs on every normal website and can read or change page content. Additional privileged host access covers Google Docs, Slides, Classroom, Google Accounts, Microsoft documents, and SchoolAI, with an optional all-sites grant.
Matches *://*/* for the main content script and adds all-frame scripts on Microsoft and SchoolAI document sites. — manifest.json:content_scripts
Declares named Google, Microsoft, and SchoolAI hosts and can request <all_urls>. — manifest.json:host_permissions, optional_host_permissions
Initializes the extension UI and integrations inside each matching page. — src/entrypoints/content/index.tsx:25-170
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Because its page access runs on every webpage, it has the technical ability to see page text and form fields. The reviewed code targets documents, assignments, comments, and its own UI; I did not find a general password, payment-field, or keystroke collector.
Loads the primary content script across all HTTP and HTTPS pages. — manifest.json:content_scripts
Finds and reads or updates assignment grade and private-comment controls. — src/modules/batch-feedback/lms/google-classroom/content/feedback/dom-injector.ts:216-546
Keyboard listeners only stop page shortcuts while focus is inside the extension UI; they do not record typed keys. — src/entrypoints/content/index.tsx:215-260
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can read signed-in Google account identities and extract Google Docs or OAuth callback tokens for its document features. It does not request the browser cookies, history, bookmarks, or downloads permissions.
Loads Google's ListAccounts endpoint and parses signed-in account names, email addresses, and profile images. — src/utils/google-accounts.ts:7-73
Injects into Google Docs to read an internal document token, email, and account index. — src/entrypoints/background/google-doc-token.ts:10-109
Monitors the extension-created OAuth popup and extracts its callback payload. — src/modules/common/background/google-scopes.ts:320-460
Does not declare cookies, history, bookmarks, or downloads. — manifest.json:permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
Its notetaker can record microphone and tab or system audio, and its file tools can read files the user selects. I found no camera, location, clipboard, native-messaging, or installed-application access.
Uses media capture and MediaRecorder for microphone and tab or display audio. — chunks/offscreen-erLOGAAg.js:1
Uploads user-selected file data through the SchoolAI API. — src/modules/file/background/process-file.ts:1-45
No nativeMessaging, clipboard, geolocation, or camera-specific browser permission is declared. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends content outside the browser when its features are used: selected webpages and documents, prompts, files, screenshots, Google authorization data, and notetaker audio go primarily to SchoolAI. Product events and logs can also go to PostHog, RudderStack, and Datadog.
Posts a selected page URL, title, and extracted HTML to SchoolAI's web-scrape endpoint. — src/modules/link-attachments/background/scrape-webpage.ts:12-98
Captures the visible tab so the screenshot feature can process and upload the image. — src/modules/chat/background/capture-screenshot.ts:8-58
Initializes PostHog and RudderStack analytics, enabled by default unless the user opts out. — src/modules/common/background/analytics.ts:80-164
Allows SchoolAI, Google/Firebase, RudderStack, and Datadog network destinations. — manifest.json:content_security_policy.connect-src
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads remote feature-flag settings from PostHog that can enable or disable predefined features. I found no path that downloads JavaScript or turns server-supplied text into executable code.
Filters remote PostHog variants to a fixed list of known extension flags and caches boolean values. — src/modules/common/background/feature-flags.ts:17-139
Configures PostHog with external dependency loading disabled. — src/modules/common/background/analytics.ts:80-132
Permits scripts only from the extension itself; no remote script origin is allowed. — manifest.json:content_security_policy.extension_pages
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically injects its interface on matching pages, initializes analytics, recovers interrupted recordings, and can open onboarding after installation. I found no autonomous search redirects, file downloads, or unrelated page openings.
Runs at page load and mounts the extension interface without a click. — src/entrypoints/content/index.tsx:25-170
Opens onboarding after installation and reinjects the content script after updates. — src/entrypoints/background/index.ts:180-215
Starts opt-out analytics automatically in production. — src/modules/common/background/analytics.ts:80-164
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains readable original source paths and embedded TypeScript for the service worker. — background.js.map:1
Contains readable original source paths and embedded TypeScript/TSX for the main content script. — content-scripts/content.js.map:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Allows self-hosted scripts and wasm-unsafe-eval, but not remote JavaScript origins. — manifest.json:content_security_policy.extension_pages
Direct review found normal JSON parsing and bundled script injection, not dynamic execution of remote text. — background.js.map and content-scripts/content.js.map:embedded first-party sources
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Sends a URL with title and HTML only when the webpage-attachment flow requests scraping. — src/modules/link-attachments/background/scrape-webpage.ts:12-98
Loads on every page but contains no general navigation-reporting call. — src/entrypoints/content/index.tsx:25-170
Navigation observation is limited to supported batch-feedback school sites and updates extension UI state. — src/modules/batch-feedback/background/navigation-events.ts:1-30
Does it create a persistent ID or browser fingerprint to recognize you?
It creates and stores a persistent analytics identifier and later associates analytics with a signed-in user ID. This recognizes the installation over time, but it is not a browser fingerprint and analytics can be disabled in the privacy settings.
Generates a distinct ID and stores it in extension-local storage. — src/modules/common/background/posthog.ts:5-31
Uses the identifier with PostHog/RudderStack and honors the stored analytics opt-out setting. — src/modules/common/background/analytics.ts:80-164
Provides a visible Share usage analytics control. — src/components/profile/privacy-settings-sheet.tsx:45-67
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends page and document content, files, screenshots, audio, and Google authorization data to SchoolAI when the corresponding feature is used. I found no evidence that it sends browser cookies or these credentials to an unrelated party.
Sends selected page HTML, title, and URL to SchoolAI. — src/modules/link-attachments/background/scrape-webpage.ts:12-98
Reads Google Docs token and account data for document operations. — src/entrypoints/background/google-doc-token.ts:10-109
Extracts and processes the extension's Google OAuth callback payload. — src/modules/common/background/google-scopes.ts:320-520
Captures visible-tab image data for the screenshot feature. — src/modules/chat/background/capture-screenshot.ts:8-58
Does it record typing, form entries, clipboard contents, or screenshots?
It can capture visible-tab screenshots and record microphone plus tab or system audio for explicit screenshot and notetaker features. It also reads and fills assignment feedback fields, but I found no general typing or clipboard logger.
Calls chrome.tabs.captureVisibleTab for the requesting tab's window. — src/modules/chat/background/capture-screenshot.ts:8-58
Uses browser media capture and MediaRecorder to record audio. — chunks/offscreen-erLOGAAg.js:1
Reads and fills grading comment and score controls as part of batch feedback. — src/modules/batch-feedback/lms/google-classroom/content/feedback/dom-injector.ts:431-546
Can a website or remote server send commands that make the extension take actions?
SchoolAI webpages can send a small set of external messages for sign-in/setup and notetaker completion. The handlers restrict accepted sites to SchoolAI origins, validate token structure or nonce where applicable, and do not expose the broader privileged handler set to arbitrary websites.
Restricts external connections to SchoolAI HTTPS origins and Chrome's extensions page. — manifest.json:externally_connectable
Checks the sender URL is a SchoolAI origin before accepting setup-token messages and validates the nonce/token flow. — src/modules/common/background/auth.ts:280-390
Accepts upload-complete messages only from the configured SchoolAI app origin. — src/modules/ai-notetaker/background/api-handlers.ts:653-682
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
UI is mounted in a shadow root; no link rewriting, ad injection, or cart manipulation logic was found in the mapped paths. — content-scripts/content.js:934-935
Limited to Google Docs comment-range tracking and a click blocker; no link or form-target modification. — comments.js:1-20
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Permissions list includes storage, tabs, activeTab, offscreen, scripting, alarms, power, webNavigation — no webRequest, declarativeNetRequest, proxy, or downloads. — manifest.json:3
Can it communicate with software on the computer or services running on localhost?
A development-only document integration can run on localhost ports 9010 and return editor HTML to an allowed SchoolAI parent frame. It does not use native messaging or scan arbitrary local services.
Includes http://localhost:9010 and http://127.0.0.1:9010 for the PowerUps document iframe script. — manifest.json:content_scripts
Requires an iframe, the direct parent window, an allowed SchoolAI/local development origin, and the expected request type before returning editor HTML. — src/entrypoints/powerups-document-iframe.content.ts:55-90
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Injects a fixed bundled function and returns structured document data through Chrome IPC. — src/entrypoints/background/google-doc-token.ts:10-109
Injects fixed bundled callback-reading code rather than decoded or server-provided JavaScript. — src/modules/common/background/google-scopes.ts:350-450
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines exact allowed hosts and validates iframe response request IDs and kinds. — src/modules/link-attachments/content/iframe-scrape-protocol.ts:32-116
Checks the direct parent source and allowlisted origin before responding. — src/entrypoints/powerups-document-iframe.content.ts:55-90
Validates extension content-script senders and message schemas before starting privileged streaming requests. — src/utils/messaging.ts:285-322
Does not allow arbitrary websites to call runtime external messaging. — manifest.json:externally_connectable
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Accepts only boolean values whose keys appear in the bundled EXTENSION_FEATURE_FLAGS list. — src/modules/common/background/feature-flags.ts:17-139
Disables PostHog external dependency loading and uses it for analytics and feature flags. — src/modules/common/background/analytics.ts:80-132
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
CSP script-src allows 'wasm-unsafe-eval' but no WASM binary files appear in the file inventory. — manifest.json:3
Resource-intensive paths (recording, screenshot, analytics) are all tied to user-initiated feature interactions, not autonomous loops. — background.js:982
Does it change form fields or where a form sends its information?
Its batch-feedback tools intentionally fill grade, score, comment, and rich-text controls in supported school sites, and its Google Docs tool can fill comment text. I found no code that changes a form's destination or silently reroutes submitted information.
Writes generated feedback and scores into Classroom textareas, inputs, and editable elements and dispatches input/change events. — src/modules/batch-feedback/lms/google-classroom/content/feedback/dom-injector.ts:431-546
Writes feedback into Canvas text or rich-text editors and triggers their normal update events. — src/modules/batch-feedback/lms/canvas/content/feedback/dom-injector.ts:400-470
Finds the Google Docs comment editor and fills the requested comment text. — src/modules/google-docs/comment-injection.ts:175-225