Is AI Toolbar - Reclaim Your Time Now safe?
AI Toolbar - Reclaim Your Time Now is medium risk. On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link. Dynamic analysis confirmed a request to the toolbar-ads endpoint; the code stores the response locally before building the anchors.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote links appear inside the ChatGPT sidebar
On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link.
Dynamic analysis confirmed a request to the toolbar-ads endpoint; the code stores the response locally before building the anchors.
You open ChatGPT while the extension is installed.
The content script only follows this sidebar path when the page URL includes chatgpt.com and the prompt field is present.
The extension inserts clickable links using titles and destinations from a remote table.
Those link definitions are loaded by the service worker and stored for the content script to read.
| Field | Value | Why it matters | |
|---|---|---|---|
Link title | Undetectable AI | This is the text you see in the ChatGPT sidebar link. | |
Link destination | https://www.stealthgpt.ai/?via=macchris | This decides where the sidebar link sends you when you click it. | |
Display order | 3 | This controls the order in which the links appear in the sidebar. |
Remote link records are fetched, stored, and rendered as anchors
async function t() {
return e || (e = await async function() {
const e = await fetch("https://ufyomstlhogygexcmicf.supabase.co/rest/v1/toolbar-ads?apikey=<redacted>");
if (!e.ok) throw new Error("Failed to fetch ads data");
return e.json()
}()), e
}
async function() {
const e = await t();
chrome.storage.local.set({
sidebarLinksData: e
}, (() => {}))
}().catch(console.error)if (DM.includes("chatgpt.com") && MM) {
const e = document.createElement("div");
e.id = "ultimate-toolbar-gpt";
const n = document.querySelector("main");
n.insertBefore(e, n.firstChild);
const o = (0, r.s)(e),
i = document.querySelector("#prompt-textarea"),
a = document.querySelector('button[data-testid="send-button"]');
setTimeout((() => {
const e = document.querySelector("nav div.flex-col div.flex-col");
if (e) {
async function t() {
const t = await async function() {
return new Promise(((e, t) => {
chrome.storage.local.get("sidebarLinksData", (n => {
n.sidebarLinksData ? e(n.sidebarLinksData) : t("No sidebar links data found")
}))
}))
}();
for (const [n, r] of t.sort(((e, t) => e.id - t.id)).entries()) {
const o = document.createElement("div");
o.style.marginTop = n === t.length - 1 ? "20px" : "0", o.style.marginBottom = 0 === n ? "10px" : "0px";
const i = document.createElement("a");
i.target = "_blank", i.href = r.url, i.textContent = r.title, i.classList.add("ul-ads"), o.appendChild(i);
const a = e.firstChild;
e.insertBefore(o, a)
}
}
t()
}
}), 3e3), o.render(t.createElement(VL, {
gptTextarea: i,
gptSendButton: a
}))
}- ufyomstlhogygexcmicf.supabase.co
Supabase project that serves toolbar-ads records used for ChatGPT sidebar links and google-btn records used on Google search pages.