Is Create Link safe?

Create Link executes user-defined JavaScript in the content script context on every page visited when a custom format filter is set.

The extension lets users define custom link format strings. When a format entry's filter field does not match the expected sed-style pattern, the extension sends that string to the content script, which executes it as arbitrary JavaScript via `new Function()`. This code runs under the content script context on all http, https, and file URLs the user visits. The options UI documents the filter field only as supporting sed-style syntax, giving no indication that arbitrary JavaScript is accepted.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.