Is Spinach AI - Daily standup that runs itself safe?

Low risk

Spinach AI strips Google Meet anti-framing headers on every meet.google.com sub-frame, not just its own embedded wrapper.

To show its meeting assistant alongside a call, Spinach AI rewrites the browser's response headers for meet.google.com: it removes the X-Frame-Options and Frame-Options headers on every sub-frame from that domain and replaces meeting pages' Content-Security-Policy with a much more permissive one that allows scripts from any source. The extension applies these rules to the whole meet.google.com domain rather than scoping them to the tab it reloads inside its own iframe, so any third-party page could also frame a Google Meet page in the same way.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Spinach AIv0.3.0Chrome Web Store
15Risk
Who publishes it

Spinach AI - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Spinach AI
Website
intercom.help/spinach_io/en/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 0.3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on meet.google.com

    https://meet.google.com/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • See every page you navigate to, as you navigate to it

    webNavigation

declarativeNetRequestWithHostAccess
Updated 2 November 2026eippeohhelpgpnchcfigkjmpepicilig