Is AI Toolbar - Reclaim Your Time Now safe?

Medium risk

AI Toolbar - Reclaim Your Time Now is medium risk. On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link. Dynamic analysis confirmed a request to the toolbar-ads endpoint; the code stores the response locally before building the anchors.

Ultimate Toolbar Gptv3.0.9Chrome Web Store
47Risk
Who publishes it

Drypto Technologies Limited - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Ultimate Toolbar Gpt
Declared legal entity
Drypto Technologies Limited
Registered address
54 Dunloe Street, London E2 8EN, GB
Registered contact
Macchris Ilo

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

warmbox.ai
Also called by 1 other listing: Apollo.io
bigspy.com
Also called by 3 other listings, including AdScout — Free Ad Spy Tool, Ad Library - Ad Finder & Adspy Tool

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote links appear inside the ChatGPT sidebar

MediumunwantedCWE-829Dynamic sandbox

On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link.

What actually happens

You did this

You open ChatGPT while the extension is installed.

The content script only follows this sidebar path when the page URL includes chatgpt.com and the prompt field is present.

The extension did this

The extension inserts clickable links using titles and destinations from a remote table.

Those link definitions are loaded by the service worker and stored for the content script to read.

Captured request

GEThttps://ufyomstlhogygexcmicf.supabase.co/rest/v1/toolbar-ads?apikey=<redacted>

200 OK observed during dynamic analysis; the available evidence did not include the response body.

Fields the extension reads from each remote link record

  • Link title
    Undetectable AI

    This is the text you see in the ChatGPT sidebar link.

  • Link destination
    https://www.stealthgpt.ai/?via=macchris

    This decides where the sidebar link sends you when you click it.

  • Display order
    3

    This controls the order in which the links appear in the sidebar.

The code that does this

Remote link records are fetched, stored, and rendered as anchors

Readable version

Service worker fetches toolbar-ads and stores the array

background.js
async function t() {  return e || (e = await async function() {    const e = await fetch("https://ufyomstlhogygexcmicf.supabase.co/rest/v1/toolbar-ads?apikey=<redacted>");    if (!e.ok) throw new Error("Failed to fetch ads data");    return e.json()  }()), e}async function() {  const e = await t();  chrome.storage.local.set({    sidebarLinksData: e  }, (() => {}))}().catch(console.error)

Content script creates ChatGPT sidebar anchors from stored records

contentScript.js
if (DM.includes("chatgpt.com") && MM) {  const e = document.createElement("div");  e.id = "ultimate-toolbar-gpt";  const n = document.querySelector("main");  n.insertBefore(e, n.firstChild);  const o = (0, r.s)(e),    i = document.querySelector("#prompt-textarea"),    a = document.querySelector('button[data-testid="send-button"]');  setTimeout((() => {    const e = document.querySelector("nav div.flex-col div.flex-col");    if (e) {      async function t() {        const t = await async function() {          return new Promise(((e, t) => {            chrome.storage.local.get("sidebarLinksData", (n => {              n.sidebarLinksData ? e(n.sidebarLinksData) : t("No sidebar links data found")            }))          }))        }();        for (const [n, r] of t.sort(((e, t) => e.id - t.id)).entries()) {          const o = document.createElement("div");          o.style.marginTop = n === t.length - 1 ? "20px" : "0", o.style.marginBottom = 0 === n ? "10px" : "0px";          const i = document.createElement("a");          i.target = "_blank", i.href = r.url, i.textContent = r.title, i.classList.add("ul-ads"), o.appendChild(i);          const a = e.firstChild;          e.insertBefore(o, a)        }      }      t()    }  }), 3e3), o.render(t.createElement(VL, {    gptTextarea: i,    gptSendButton: a  }))}

Remote services involved in the link configuration

    • ufyomstlhogygexcmicf.supabase.co

    Supabase project that serves toolbar-ads records used for ChatGPT sidebar links and google-btn records used on Google search pages.

What it can do

Permissions this extension asks for, as declared in version 3.0.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Updated 30 September 2026bjkmnimffmhjbfikbempnbanngnnmknc