Is Axhub safe?

Axhub accepts page-supplied URLs to fetch and execute remote JavaScript in any open tab via chrome.scripting.executeScript.

The extension's background service listens for internal messages containing a caller-supplied URL, fetches that URL's content with no domain validation, caches it in chrome.storage.local, and then injects the retrieved code into the MAIN world of any tab the user has open. Separately, a CustomEvent listener in the content script allows page-level JavaScript to overwrite the extension's WebSocket endpoint in storage, redirecting the Genie AI Editor connection to an arbitrary server on the next launch.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.