Is SkipIt Adblocker for Youtube safe?

Question

Accepted Answer

SkipIt Adblocker for Youtube is critical risk. Code analysis shows that this extension injects a script into every HTTPS page you visit. That script reads two HTML meta tags from the page — one for a passphrase and one for an encrypted payload — decrypts the payload using PBKDF2 and AES-GCM, then runs the result as JavaScript code using the AsyncFunction constructor (equivalent to eval). Any website that controls its own meta tags can provide a passphrase and matching ciphertext, causing the extension to execute arbitrary JavaScript in the page's context. The decryption and execution run on every HTTPS origin, and failures are caught and discarded without notification. Code analysis shows that the extension's execution gate relies on a symmetric passphrase to decrypt a payload before running it. However, both the passphrase (meta[name=rating]) and the ciphertext (meta[name=source]) are read from the page's own DOM. A page that controls both meta tags can choose any passphrase, encrypt a payload under that passphrase, and supply both — so the encryption provides no authentication against the page the script is already running inside. There is no signature, no extension-bundled key, and no allowlist of permitted operations between decryption and execution.

Is SkipIt Adblocker for Youtube safe?

Findings