Is AI Toolbar - Reclaim Your Time Now safe?
AI Toolbar - Reclaim Your Time Now is medium risk. On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link. Dynamic analysis confirmed a request to the toolbar-ads endpoint; the code stores the response locally before building the anchors.
Who publishes itDrypto Technologies Limited - no other listings under this identity, 2 shared hostnames
Drypto Technologies Limited - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote links appear inside the ChatGPT sidebar
On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link.
Dynamic analysis confirmed a request to the toolbar-ads endpoint; the code stores the response locally before building the anchors.
What actually happens
You open ChatGPT while the extension is installed.
The content script only follows this sidebar path when the page URL includes chatgpt.com and the prompt field is present.
The extension inserts clickable links using titles and destinations from a remote table.
Those link definitions are loaded by the service worker and stored for the content script to read.
Captured request
200 OK observed during dynamic analysis; the available evidence did not include the response body.
Fields the extension reads from each remote link record
- Link titleUndetectable AI
This is the text you see in the ChatGPT sidebar link.
- Link destinationhttps://www.stealthgpt.ai/?via=macchris
This decides where the sidebar link sends you when you click it.
- Display order3
This controls the order in which the links appear in the sidebar.
The code that does this
Remote link records are fetched, stored, and rendered as anchors
Service worker fetches toolbar-ads and stores the array
background.jsasync function t() { return e || (e = await async function() { const e = await fetch("https://ufyomstlhogygexcmicf.supabase.co/rest/v1/toolbar-ads?apikey=<redacted>"); if (!e.ok) throw new Error("Failed to fetch ads data"); return e.json() }()), e}async function() { const e = await t(); chrome.storage.local.set({ sidebarLinksData: e }, (() => {}))}().catch(console.error)Content script creates ChatGPT sidebar anchors from stored records
contentScript.jsif (DM.includes("chatgpt.com") && MM) { const e = document.createElement("div"); e.id = "ultimate-toolbar-gpt"; const n = document.querySelector("main"); n.insertBefore(e, n.firstChild); const o = (0, r.s)(e), i = document.querySelector("#prompt-textarea"), a = document.querySelector('button[data-testid="send-button"]'); setTimeout((() => { const e = document.querySelector("nav div.flex-col div.flex-col"); if (e) { async function t() { const t = await async function() { return new Promise(((e, t) => { chrome.storage.local.get("sidebarLinksData", (n => { n.sidebarLinksData ? e(n.sidebarLinksData) : t("No sidebar links data found") })) })) }(); for (const [n, r] of t.sort(((e, t) => e.id - t.id)).entries()) { const o = document.createElement("div"); o.style.marginTop = n === t.length - 1 ? "20px" : "0", o.style.marginBottom = 0 === n ? "10px" : "0px"; const i = document.createElement("a"); i.target = "_blank", i.href = r.url, i.textContent = r.title, i.classList.add("ul-ads"), o.appendChild(i); const a = e.firstChild; e.insertBefore(o, a) } } t() } }), 3e3), o.render(t.createElement(VL, { gptTextarea: i, gptSendButton: a }))}Remote services involved in the link configuration
- ufyomstlhogygexcmicf.supabase.co
Supabase project that serves toolbar-ads records used for ChatGPT sidebar links and google-btn records used on Google search pages.
What it can do
Permissions this extension asks for, as declared in version 3.0.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
See every page you navigate to, as you navigate to it
webNavigation
