Is Trashie safe?

Medium risk

Trashie is medium risk. Code analysis shows the bundled Sleek SDK can serialise a shop page's full HTML and POST it with the URL and title to api.onsleek.ai when the site is allowlisted.

v4.1.1Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sleek SDK sends page HTML, URL and title to api.onsleek.ai on allowlisted shops

Code analysis shows the bundled Sleek SDK can serialise a shop page's full HTML and POST it with the URL and title to api.onsleek.ai when the site is allowlisted.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page on a shop the Sleek allowlist enables classification for.

The script is registered on all URLs except a social, mail and bank denylist.

The extension did this

The SDK serialises the page HTML and posts it, with the URL and title, to api.onsleek.ai.

A cached answer from the server skips the upload.

The code that does this

Classification path in the SDK content script

Readable version

DOM capture used for the upload

mf.js
captureDomString = async (a = !0, e = !0) => {  const o = this.sdkOptionsService.getOptions().cssSelectorsToSkipCapture ?? [],    i = Array.from(document.querySelectorAll("iframe")),    n = S(document.documentElement, o, a, e, s);  if (!n || n.nodeType !== G.Node.ELEMENT_NODE) throw new Error("Failed to capture DOM string");  return n.outerHTML.replace(/>\s+</g, "><")
Body of the POST to api.onsleek.ai/v1/page-classification
  • Page HTML
    <html><head><title>Checkout</title></head><body>...</body></html>

    The whole document including iframe contents, with whitespace between tags removed.

  • Page URL
    https://shop.example.com/cart?session=8f3a1c

    The full address of the page you are viewing, including query string.

  • Page title
    Your Cart | Example Shop

    The title of the tab at the time of capture.

Destinations in the SDK code
    • api.onsleek.ai

    Receives page HTML, URL and title; also serves the allowlist and page classification answers.

    • us.i.posthog.com

    Receives extracted product names, prices and URLs on cart and product pages, per the code.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Updated 15 October 2026mhaamcbaeggmpmmdppgeimpkmnfmhgpc