Is Ghostwrite: ChatGPT Email Assistant safe?
Ghostwrite: ChatGPT Email Assistant is critical risk. In Gmail or Outlook, this assistant downloads JS from app.ghostwrite.rip and eval()s it in the mail page on load, so future server responses get full access to your email and session, no update needed. A hidden field tells it the server.
Who publishes itLatent Representation Systems LLC - no other listings under this identity
Latent Representation Systems LLC - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension downloads and runs remote JavaScript inside Gmail and Outlook pages
In Gmail or Outlook, this assistant downloads JS from app.ghostwrite.rip and eval()s it in the mail page on load, so future server responses get full access to your email and session, no update needed.
A hidden field tells it the server.
What actually happens
You open a Gmail or Outlook message.
The extension downloads a script from app.ghostwrite.rip and runs it inside the mail page with eval().
The behavior can change any time the server changes its response, with no extension update.
Captured request
The code that does this
The loader fetches the remote file and passes the response text straight to eval().
The code that does this
The content script writes a hidden gwURL input field, then injects the loader that reads it.
Observation
The remote script is served from the developer's own infrastructure and dynamic analysis only observed it being fetched and executed; the content returned at the time of analysis was not retained for inspection. The finding is the remote-code-execution capability itself - code outside the published, reviewed extension package runs inside logged-in Gmail and Outlook tabs and can be changed server-side at any time.
What it can do
Permissions this extension asks for, as declared in version 0.0.0.18. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on dev.ghostwrite.rip
https://dev.ghostwrite.rip/* and 1 more
Read and change your data on app.ghostwrite.rip
https://app.ghostwrite.rip/
Read and change your data on outlook.live.com
https://outlook.live.com/*
Read and change cookies, including the ones that keep you signed in
cookies
Block and redirect the requests your browser makes
declarativeNetRequest
See which of your requests its blocking rules matched
declarativeNetRequestFeedback