Is Pixels Game Assistant safe?
Pixels Game Assistant loads a script URL from its own server's config and injects it into play.pixels.xyz with no integrity check.
On every visit to play.pixels.xyz, the extension fetches a configuration JSON from api-pixels.guildpal.com and, if that response names a script URL, appends a <script> tag pointing to it directly into the page. There is no signature, hash, or domain allowlist on that URL, so whatever the server returns runs with full access to the page. This makes the extension's own backend a single point of control over code execution on that site for every installed user.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Pixels Game Assistant contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api-pixels.guildpal.com
Pixels Game Assistant sends data to api-pixels.guildpal.com. No other extension we have analysed sends data here.