Crowdly is published by undrfined.

Is Crowdly – AI Study Assistant for Moodle safe?

Medium risk

Crowdly is medium risk. Sending a message in Crowdly's AI chat panel includes your message text in a PostHog analytics event sent to ph.crowdly.sh, carrying chat content beyond the core chat request.

undrfinedv4.0.5Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AI chat messages sent to developer analytics endpoint

Sending a message in Crowdly's AI chat panel includes your message text in a PostHog analytics event sent to ph.crowdly.sh, carrying chat content beyond the core chat request.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

The user sends a message in the AI chat panel.

The extension did this

The extension includes the message text in an analytics event sent to its PostHog endpoint.

Captured request

POSThttps://ph.crowdly.sh

Fields in the request

AI chat message text
How can I summarize this Moodle assignment? (illustrative)
The analytics event includes the text typed into the AI chat panel, up to 2000 characters.

Observation

Dynamic analysis confirmed that the extension records the AI chat send action as a PostHog event and includes the submitted message text as an event property.