Is SkoleGPT Webudvidelse safe?

SkoleGPT Webudvidelse reads DOM text and screenshots from every active tab and transmits them to llm.dbc.dk using hardcoded API keys.

When used as a page assistant, the extension captures up to 12,000 characters of DOM text and, for vision-capable models, a JPEG screenshot of the active tab, then sends both to the vendor LLM endpoint at llm.dbc.dk. A separate hardcoded key is used to send text to the Danish TTS service at glyph-gate.dbc.dk for audio playback. Both API keys are embedded in plain text in sidepanel.js and are readable by anyone who extracts the extension package.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.