Is AI Chrome Extension powered by ChatGPT - Magictool AI safe?

Medium risk

Magictool AI is medium risk. Magictool AI sends usage events to Matomo at analytics.25trends.me: user ID, user agent, screen resolution, plan tier, action names (mode change, question, setting, trigger, click, screenshot). Not listed in the description or permissions.

Magictool.aiv1.5.1Chrome Web Store
47Risk
Who publishes it

Magictool.ai - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Magictool.ai
Website
magictool.ai/chrome/support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Usage telemetry with user ID is sent to third-party Matomo analytics.

Magictool AI sends usage events to Matomo at analytics.25trends.me: user ID, user agent, screen resolution, plan tier, action names (mode change, question, setting, trigger, click, screenshot).

Not listed in the description or permissions.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You take actions in the extension, including changing modes, asking questions, changing settings, using commands, registering, or taking screenshots.

The extension did this

The extension sends per-event usage telemetry with a user ID and event details to a third-party Matomo analytics endpoint.

Captured request
GEThttps://analytics.25trends.me/matomo.php
Fields in the analytics request
  • Your usage event context
    Mode changed to: chat

    The action name describing what you did, e.g. a mode change, question, setting change, command trigger, registration click, or screenshot.

  • Your stored user profile context
    uid=12345; plan=free (illustrative)

    The request includes stored values such as a user ID and plan tier that can connect multiple analytics events to the same extension user.

Observation

Dynamic analysis confirmed that the analytics code is enabled by default through the usageAnalyticsDisabled setting and sends events with user and browser context to the Matomo endpoint.

What it can do

Permissions this extension asks for, as declared in version 1.5.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/* and 1 more

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

  • Read whatever you have copied to your clipboard

    clipboardRead

Updated 30 September 2026fedmdabgnkfghjplejeilojikdaopkpm