Is Shepherd: Focus & Productivity Time Tracker safe?

Medium risk

Shepherd records page content and sessions on every site and sends them to Composite's servers.

On all websites, the extension runs the Composite SDK, which records the page's DOM, network activity and console output, and passes it through the background worker to Composite's ingestion API. Input fields are not masked by default. It also sends the URL and title of each tracked tab to a Cloudflare worker to score productivity.

Shepherdv0.0.7Chrome Web Store
51Risk
Who publishes it

Shepherd - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Shepherd
Website
shepherdtime.com/contact

Same store account

1 other listing published from this account, 35 users between them, none of them carrying a finding.

ChatGPT Ad Blocker - Block Ads on ChatGPT & AI Chatbots35Low

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

prod.alb.us.api.composite.com
Also called by 2 other listings: OTPal: Auto-Detect & Copy OTP, 2FA & Verification Codes from Gmail, Composite Extension

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Composite SDK records page DOM and network activity on every site you visit

Code analysis shows a content script on all pages starts rrweb session recording and sends it to prod.alb.us.api.composite.com.

Input masking is off unless server config sets it.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any ordinary web page.

The content script is declared for all URLs.

The extension did this

The extension starts recording the page's DOM, network calls and console output.

Records are batched and sent to the vendor's ingest host.

The code that does this

SDK initialisation with recording options

Readable version
await Te.init({  apiKey: pa,  apiHost: fa,  transport: "chrome-extension",  autocapture: { capture_pageview: !0 },  sessionRecording: {    networkCapture: !0,    enableRecordingConsoleLog: !0,    compress: !0  },  loaded: e => {}})
The code that does this

rrweb recorder options

Readable version

Recorder start

content.js
let e = {  emit: this.onRRwebEmit.bind(this),  maskAllInputs: this.options.maskAllInputs ?? !1,  maskTextSelector: this.options.maskSelector,  blockSelector: this.options.blockSelector,  inlineStylesheet: this.options.inlineStylesheet ?? !0,  collectFonts: this.options.collectFonts ?? !0,  sampling: this.options.sampling ?? { mousemove: !0, mouseInteraction: !0, scroll: 150, media: 800, input: "last" }};this.stopRecording = Ue(e)
Data categories the recording can include
  • Page URL
    https://mail.example.com/inbox

    Shows which pages you visit.

  • Page content
    rrweb full snapshot (type 2)

    A snapshot of what is on screen, including text you see.

  • Form input
    maskAllInputs: false

    Typed values are not masked unless server config says so.

  • Network calls
    networkCapture: true

    Requests the page makes are logged alongside the recording.

Destination host
    • prod.alb.us.api.composite.com

    Receives /ingest/configuration, /ingest/e, /ingest/batch and gzip /ingest/s with a Bearer key.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 0.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Show a panel beside the page

    sidePanel

  • Run its own code inside the pages you visit

    scripting

  • Detect when you step away from your computer

    idle

Where it sends data

Destinations our analysis observed Shepherd: Focus & Productivity Time Tracker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • prod.alb.us.api.composite.com

    Shepherd: Focus & Productivity Time Tracker sends data to prod.alb.us.api.composite.com. No other extension we have analysed sends data here.

  • url-classifier.composite.workers.dev

    Shepherd: Focus & Productivity Time Tracker sends data to url-classifier.composite.workers.dev. No other extension we have analysed sends data here.

Updated 15 October 2026hkkofcjgmaiigakmdfifjkkjinljdimj