Is Research Assistant - Auto Citation Tool safe?

Research Assistant - Auto Citation Tool renders saved highlights via innerHTML, letting page text run script inside its popup.

When you highlight text on any page and save it as a note, the extension stores that text verbatim and later inserts it into the popup's notes list without sanitizing it. If the highlighted text contains HTML markup, that markup is parsed and can run as active script inside the extension's own popup, which can then read every note saved from every site (via chrome.storage.local) and send it to any web address, since the extension has permission to contact any origin.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.