Is SiaBot - Siaep MA safe?
SiaBot - Siaep MA sends SIAEP school, user, class, and worksheet row counts to a Google Apps Script endpoint.
When you click popup buttons or certain injected help links on SIAEP pages, the extension reads page labels for the school, logged-in user or teacher, class, and table row count. It base64-encodes those fields and sends them as a query parameter to a hardcoded script.google.com URL before running the selected helper script.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup actions send SIAEP page metadata to a Google Apps Script endpoint.
When you use the SiaBot popup on a SIAEP page, the extension reads school, teacher, class, and worksheet row-count details from the page.
It sends those DOM and form-derived values to a hardcoded Google Apps Script endpoint.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
A user clicks a button in the extension popup while on a SIAEP page.
The extension reads SIAEP school, teacher, class, and worksheet row-count metadata and sends it to a hardcoded Google Apps Script endpoint.
- SIAEP page contentExample School | Example Teacher | Class 6A | 24 rows (illustrative)
School, teacher, class, and worksheet row-count text identifies the education context shown in the active page.
- Form-derived page valuesClass 6A worksheet rows: 24 (illustrative)
Values read from SIAEP page elements can describe the selected classroom or worksheet state.
Verification confirmed that the extension scope is limited to the SIAEP education domain and that popup handling reads page metadata before forwarding it to the Google Apps Script endpoint.
Where it sends data
Destinations our analysis observed SiaBot - Siaep MA contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- script.google.com
SiaBot - Siaep MA sends data to script.google.com. 12 other extensions we have analysed send data here.