Is AI Toolbar - Reclaim Your Time Now safe?

Medium risk

AI Toolbar - Reclaim Your Time Now is medium risk. On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link. Dynamic analysis confirmed a request to the toolbar-ads endpoint; the code stores the response locally before building the anchors.

Ultimate Toolbar Gptv3.0.9Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote links appear inside the ChatGPT sidebar

On ChatGPT, the extension loads a Supabase table and turns each title/URL into a clickable sidebar link.

Dynamic analysis confirmed a request to the toolbar-ads endpoint; the code stores the response locally before building the anchors.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open ChatGPT while the extension is installed.

The content script only follows this sidebar path when the page URL includes chatgpt.com and the prompt field is present.

The extension did this

The extension inserts clickable links using titles and destinations from a remote table.

Those link definitions are loaded by the service worker and stored for the content script to read.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://ufyomstlhogygexcmicf.supabase.co/rest/v1/toolbar-ads?apikey=<redacted>
200 OK observed during dynamic analysis; the available evidence did not include the response body.
03EvidenceFIELD TABLE
Fields the extension reads from each remote link record
FieldValueWhy it matters
Link title
Undetectable AIThis is the text you see in the ChatGPT sidebar link.
Link destination
https://www.stealthgpt.ai/?via=macchrisThis decides where the sidebar link sends you when you click it.
Display order
3This controls the order in which the links appear in the sidebar.
04EvidenceCODE COMPARE
The code that does this

Remote link records are fetched, stored, and rendered as anchors

What it actually does
Service worker fetches toolbar-ads and stores the arraybackground.js
async function t() {
  return e || (e = await async function() {
    const e = await fetch("https://ufyomstlhogygexcmicf.supabase.co/rest/v1/toolbar-ads?apikey=<redacted>");
    if (!e.ok) throw new Error("Failed to fetch ads data");
    return e.json()
  }()), e
}
async function() {
  const e = await t();
  chrome.storage.local.set({
    sidebarLinksData: e
  }, (() => {}))
}().catch(console.error)
Content script creates ChatGPT sidebar anchors from stored recordscontentScript.js
if (DM.includes("chatgpt.com") && MM) {
  const e = document.createElement("div");
  e.id = "ultimate-toolbar-gpt";
  const n = document.querySelector("main");
  n.insertBefore(e, n.firstChild);
  const o = (0, r.s)(e),
    i = document.querySelector("#prompt-textarea"),
    a = document.querySelector('button[data-testid="send-button"]');
  setTimeout((() => {
    const e = document.querySelector("nav div.flex-col div.flex-col");
    if (e) {
      async function t() {
        const t = await async function() {
          return new Promise(((e, t) => {
            chrome.storage.local.get("sidebarLinksData", (n => {
              n.sidebarLinksData ? e(n.sidebarLinksData) : t("No sidebar links data found")
            }))
          }))
        }();
        for (const [n, r] of t.sort(((e, t) => e.id - t.id)).entries()) {
          const o = document.createElement("div");
          o.style.marginTop = n === t.length - 1 ? "20px" : "0", o.style.marginBottom = 0 === n ? "10px" : "0px";
          const i = document.createElement("a");
          i.target = "_blank", i.href = r.url, i.textContent = r.title, i.classList.add("ul-ads"), o.appendChild(i);
          const a = e.firstChild;
          e.insertBefore(o, a)
        }
      }
      t()
    }
  }), 3e3), o.render(t.createElement(VL, {
    gptTextarea: i,
    gptSendButton: a
  }))
}
05EvidenceTHIRD PARTY LIST
Remote services involved in the link configuration
  • ufyomstlhogygexcmicf.supabase.co

    Supabase project that serves toolbar-ads records used for ChatGPT sidebar links and google-btn records used on Google search pages.

Updated 17 September 2026bjkmnimffmhjbfikbempnbanngnnmknc