Is Goby safe?
Goby lets pages set their wallet session origin and use permissions granted to another site.
Goby injects a page provider that accepts a tabCheckin request from pages and forwards the page-supplied origin to the service worker. Because later permission checks use that stored origin, a page can present itself as a previously connected site and call permission-gated wallet methods such as accounts, getPublicKeys, and getAssetBalance.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes ithttps://goby.app - no other listings under this identity
https://goby.app - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 0.5.17. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Schedule its own background tasks
alarms
Act on the current tab, but only after you click the extension
activeTab
Show you desktop notifications
notifications
Run hidden pages in the background
offscreen