Is Homework Helper - Study, Quiz, & Test Answers Solver with AI safe?
We analyzed Homework Helper - Study, Quiz, & Test Answers Solver with AI version 1.3.0's actual code and gave it a 62/100 trust score. Useful for its…
Bottom line
Useful for its stated purpose, but broad website access and transmission of selected or quiz content warrant caution.
What it can access
It runs across every website and can read selected text or quiz content before sending it to the service, which fits the feature but is broad access. [Q1][Q3][Q6]
Security weaknesses
Answer and error content from the service is inserted into webpages without demonstrated sanitization, so untrusted content could alter those pages. [Q2][Q7]
Signs of misuse
No evidence shows browsing tracking, advertising manipulation, hidden control, or other misuse; information is sent after an answer request for the advertised feature. [Q6][Q12][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs a page access in every frame on every website and requests storage, tabs, and context-menu access. The all-site reach makes selection-based answering work anywhere, but is much broader than the specialized Canvas integration needs.
Declares storage, tabs, and contextMenus permissions and a content script matching <all_urls> with all_frames enabled. — manifest.json:1
Registers the selection helper globally and enables Canvas-specific parsing on instructure.com. — assets/content-script.tsx-def17458.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It adds a floating Ask control after text selection, inserts answer buttons into Canvas questions, and opens draggable login/answer dialogs. Remote answers and error messages are inserted as raw HTML, which can affect the current page beyond the advertised UI.
Appends toolbar, modal, wrapper, and per-question React roots to document.body and Canvas question elements. — assets/content-script.tsx-def17458.js:1
Renders answer and notice strings through dangerouslySetInnerHTML without an HTML sanitizer. — assets/content-script.tsx-def17458.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads selected text on any website. On Canvas/Instructure it also reads quiz question text, answer choices, course/quiz/question identifiers, and the platform hostname.
Uses window.getSelection().toString() to populate the global selection toolbar and Ask modal. — assets/content-script.tsx-def17458.js:1
Queries .question, .question_text, and .answers .answer on Instructure pages and derives course, quiz, and question IDs from the DOM and path. — assets/content-script.tsx-def17458.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It checks the current hostname on every page and reads the Canvas URL path to derive course and quiz identifiers. No visited-page log or tabs-based browsing-history collection was found.
Checks window.location.hostname and, on Instructure, reads pathname segments for course and quiz IDs. — assets/content-script.tsx-def17458.js:1
Uses tabs for OAuth/account flows and sending a user-invoked context-menu message, not continuous tab enumeration. — assets/background.ts-8c67d9fc.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write an answer to the clipboard after the user clicks Copy. No clipboard read, camera, microphone, screen capture, downloads, or local-file access was found.
The answer component calls navigator.clipboard.writeText only from its Copy button handler. — assets/content-script.tsx-def17458.js:1
Requests no capture, downloads, nativeMessaging, or file-related permission. — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
After an Ask click it sends selected text or Canvas question/context/options to app.tryhomeworkhelper.com with the user's Supabase bearer token. Optional feedback stores the full question, returned answer, rating, and account/quiz identifiers in Supabase.
POST helper targets https://app.tryhomeworkhelper.com and adds the current session access token as a bearer Authorization header. — assets/http-client-d4e83175.js:1
POSTs selection or question/context/options on explicit Ask actions, then inserts or upserts question and answer feedback into the Supabase feedback table. — assets/content-script.tsx-def17458.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The vendor server supplies the answer and error content displayed inside the current site. It does not send a formal command language, but the response is trusted as raw HTML, so remote output can control injected page markup.
Joins response data into the answer string and passes it to a component that uses dangerouslySetInnerHTML. — assets/content-script.tsx-def17458.js:1
Interpolates a failed API response message into notice HTML and also renders that notice with dangerouslySetInnerHTML. — assets/content-script.tsx-def17458.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The all-site selection listener and toolbar run automatically unless disabled, and Canvas questions are reparsed every ten seconds. Actual query uploads remain gated on a user Ask click.
Registers a document mouseup listener and shows the helper by default unless showHelper is explicitly false. — assets/content-script.tsx-def17458.js:1
Calls the Canvas scanner immediately and every 10 seconds, marking processed questions with __visited___. — assets/content-script.tsx-def17458.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests none of the permissions used to change browser-wide network or search settings. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Minified bundle retains readable API routes, DOM selectors, component strings, and first-party control flow. — assets/content-script.tsx-def17458.js:1
Large misleadingly named shared chunk is predominantly bundled React/UI/browser support code imported by extension pages and content script. — assets/logo-27cf0895.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Complete package inventory was used to enumerate every JavaScript file. — inventory.json:1
Uses only function callbacks for timers; no text-to-code primitive occurs in the active content runtime. — assets/content-script.tsx-def17458.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Location use is limited to hostname/platform checks and Canvas course/quiz path parsing. — assets/content-script.tsx-def17458.js:1
Tab access supports OAuth, opening the account page, and messaging the current context-menu tab; no history store exists. — assets/background.ts-8c67d9fc.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Configures Supabase authentication/database transport; no analytics SDK or event collector is instantiated. — assets/prepare-message-1da08bac.js:1
Writes to the feedback table only from explicit Good Answer or Bad Answer controls. — assets/content-script.tsx-def17458.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It handles credentials and bearer tokens for its own Homework Helper account. Email/password login goes to Supabase Auth, Google OAuth tokens are parsed from the authentication callback, and the resulting session is persisted in extension-local storage; it does not read credentials from host websites.
Injected product login form passes its own email and password to supabase.auth.signInWithPassword. — assets/content-script.tsx-def17458.js:1
Completes Google OAuth by reading callback access_token and refresh_token values and calling setSession. — assets/background.ts-8c67d9fc.js:1
Persists the Supabase session under __homeworkhelper__session__ in chrome.storage.local. — assets/prepare-message-1da08bac.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Global event registration is for mouseup selection handling; no page keypress/keydown/input/password listener exists. — assets/content-script.tsx-def17458.js:1
Requests no tabCapture, desktopCapture, camera, or microphone access. — manifest.json:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
API response answer and message fields flow into raw HTML renderers within content-script UI. — assets/content-script.tsx-def17458.js:1
Background behavior is a fixed set of auth, account, subscription, context-menu, and same-extension message handlers. — assets/background.ts-8c67d9fc.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
First-party API traffic targets only the Homework Helper application service. — assets/http-client-d4e83175.js:1
Injected UI is limited to account, selection, quiz-answer, feedback, and upgrade controls. — assets/content-script.tsx-def17458.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, debugger, proxy, or cookies permission. — manifest.json:1
Performs ordinary first-party fetch requests for the service rather than intercepting browser traffic. — assets/http-client-d4e83175.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging, downloads, fileSystem, or file URL permission. — manifest.json:1
A localhost URL appears only as a bundled Supabase library default; the configured client uses the vendor's HTTPS Supabase project. — assets/prepare-message-1da08bac.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Answer handling only replaces newlines with <br/> before assigning the result through dangerouslySetInnerHTML. — assets/content-script.tsx-def17458.js:1
Server error message is interpolated into an HTML template and rendered the same way without sanitization. — assets/content-script.tsx-def17458.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no externally_connectable origins or IDs. — manifest.json:1
Runtime listener validates a prepared internal message and accepts only ON_SELECT_AND_ASK. — assets/content-script.tsx-def17458.js:1
Background listener validates an internal action and exposes only the Google-auth flow. — assets/background.ts-8c67d9fc.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Enables the question scanner only when hostname ends with instructure.com, while selection handling is global. — assets/content-script.tsx-def17458.js:1
Fetches account subscription and profile data after authentication and stores it for query eligibility/usage UI. — assets/background.ts-8c67d9fc.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Content script is configured for <all_urls> and all_frames. — manifest.json:1
Imports large shared UI/auth chunks, registers a global mouseup listener, and schedules the Instructure scanner at 10-second intervals. — assets/content-script.tsx-def17458.js:1
Content script is 78,814 bytes and its shared logo/UI and prepare-message/auth chunks are 578,250 and 109,012 bytes. — inventory.json:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Canvas integration reads question and answer elements and appends its own wrapper; it never assigns to page form fields or actions. — assets/content-script.tsx-def17458.js:1
The product login form and editable selection textarea belong to the injected extension modal and do not redirect host forms. — assets/content-script.tsx-def17458.js:1