Is Create Link safe?

Medium risk

Create Link executes user-defined JavaScript in the content script context on every page visited when a custom format filter is set.

The extension lets users define custom link format strings. When a format entry's filter field does not match the expected sed-style pattern, the extension sends that string to the content script, which executes it as arbitrary JavaScript via `new Function()`. This code runs under the content script context on all http, https, and file URLs the user visits. The options UI documents the filter field only as supporting sed-style syntax, giving no indication that arbitrary JavaScript is accepted.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

42Risk
Who publishes it

ku - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ku

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 0.5.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Add items to the right-click menu

    contextMenus

  • Store data in your browser

    storage

  • Write to your clipboard

    clipboardWrite

Updated 30 September 2026gcmghdmnkfdbncmnmlkkglmnnhagajbm