Is ChatGPT Image Auto safe?
Queues ChatGPT image prompts and downloads each generated image automatically.
This extension adds a side panel for running a line-by-line batch of image prompts in ChatGPT, processing them one at a time and showing each row’s status. It can attach reference images to prompts, choose aspect ratio and prompt-splitting options, retry failed rows, and keep a library of generated images with their prompts and source conversation links.
Who publishes itDuck Martians AI Labs - 4 other listings from the same operator, 1 of them carrying a finding
Duck Martians AI Labs - 4 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 111k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Anti-Analysis Guard Disables Script Injection on Deobfuscated Copies
The background worker and side panel check if they're running from minified or formatted source.
When formatted, as in analysis pipelines, the extension swaps its script-injection API for a stub returning empty, hiding injection activity.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
The extension's background service worker and side panel both run on load.
Each file executes the environment-detection block before any other logic.
If the source file contains a newline, indicating formatted or deobfuscated code, chrome.scripting.executeScript is replaced with a stub that always returns an empty array.
The stub returns a resolved Promise with no results and no error; callers receive an empty result with no indication that injection was suppressed.
Anti-analysis guard, shipped (minified) vs deobfuscated
background.js — deobfuscated (newline present → guard fires)
background.jsvar _$g = (function _$f() { return _$f.toString().indexOf("\n") === -1})();if (!_$g) { var _$o = chrome.scripting.executeScript; chrome.scripting.executeScript = function() { return Promise.resolve([]) }}sidepanel.js — same guard (minified inline at top of file)
sidepanel.jsvar _$g=(function _$f(){return _$f.toString().indexOf("\n")===-1})();if(!_$g){var _$o=chrome.scripting.executeScript;chrome.scripting.executeScript=function(){return Promise.resolve([])}}Simulates the IIFE check against minified and formatted versions of the guard function to confirm the patch fires only on deobfuscated source.
- Node.js 14+
// Run with Node.js — no dependencies required.// Reproduces the IIFE newline-detection logic from background.js and sidepanel.js.const minified = `(function _$f(){return _$f.toString().indexOf("\\n")===-1})()`;const formatted = `(function _$f() {\n return _$f.toString().indexOf("\\n") === -1\n})()`;function evalGuard(src) { // Safe: no network, no chrome API — pure string/function eval. return eval(src);}const minifiedResult = evalGuard(minified);const formattedResult = evalGuard(formatted);console.log('Minified => guard result:', minifiedResult, '(true = no patch, normal execution)');console.log('Formatted => guard result:', formattedResult, '(false = patch fires, executeScript suppressed)');if (minifiedResult === true && formattedResult === false) { console.log('\nCONFIRMED: Anti-analysis guard present and operational.'); console.log('Dynamic analysis pipelines running deobfuscated source will see executeScript replaced with a no-op.');} else { console.log('\nNot confirmed — results unexpected.');}- 1Save this file as detect-antianalysis-guard.js.
- 2Run: node detect-antianalysis-guard.js.
- 3Look for "CONFIRMED" in the output.
The patch only fires when source is formatted (i.e., has newlines). The packed CRX as distributed to end users runs in minified form, so the guard does not activate in production. The risk is specifically that dynamic analysis tools — which typically work from beautified or deobfuscated copies — will not observe any `chrome.scripting.executeScript` calls, even if the extension makes them. This is a deliberate analysis-evasion technique, not a side-effect of minification.
Where it sends data
Destinations our analysis observed ChatGPT Image Auto contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- chatgpt.comwidely used
ChatGPT Image Auto sends data to chatgpt.com. A widely used service: 37 other extensions we have analysed send data here.