Is ePadLink SigCaptureWeb SDK Extension safe?

ePadLink SigCaptureWeb SDK Extension relays arbitrary page-controlled data to a local native signature-pad application on every website.

The extension's content script runs on all websites and listens for a custom DOM event. When fired, it reads a page-supplied attribute verbatim and forwards it through the background script to the native messaging host com.epadlink.sigcapturewebsdk.win — a locally installed signature-capture application — without validating which site triggered the event. As a side effect, the content script also writes an attribute to the document root on every page it loads, allowing any website to detect that the extension is installed.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.