Is Twiclips - Twitch Clip Downloader safe?
Twiclips sends Twitch clip and VOD URLs with a persistent user ID and IP-derived profile data to Alibaba Cloud logging.
On install, Twiclips requests IP geolocation from ipinfo.io and then ip-api.com, storing the returned IP profile data locally. When you use its Twitch clip, VOD download, or search buttons, it sends the exact Twitch URL with a persistent UID, install time, IP address, country, language, browser, and OS to an Aliyun SLS logging endpoint.
Who publishes itabel.sonmerfield - 1 other listing from the same operator, none carrying a finding
abel.sonmerfield - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 40k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Twitch download clicks send clip URLs and profile data to Alibaba Cloud.
When you click Twiclips' download or search controls on a Twitch clip or VOD page, the extension sends the Twitch URL to Alibaba Cloud logging, with a persistent UID plus IP-derived country, language, browser, OS, and install-time data.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user clicks a Twiclips download, detail download, or search control on Twitch.
The extension sends the Twitch clip or VOD URL with persistent UID and IP-derived profile data to Alibaba Cloud logging.
- Twitch clip or VOD URLhttps://www.twitch.tv/videos/123456789 (illustrative)
Shows which Twitch clip or VOD page was involved in the download or search action.
- IP-derived profile datacountry=US (illustrative)
Adds network-derived location context such as country to the same log event.
- Persistent extension storage valuesuid=d7f3a1b2-...; install_time=2026-07-13T00:00:00Z (illustrative)
Links events to stored extension values such as UID and install time.
What it can do
Permissions this extension asks for, as declared in version 1.0.12. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on facebook.com
*://*.facebook.com/*
Read and change your data on twitter.com
*://*.twitter.com/*
Read and change your data on pinterest.com
*://*.pinterest.com/*
Read and change your data on reddit.com
*://*.reddit.com/*
Read and change your data on aliyuncs.com
*://*.aliyuncs.com/*
Read and change your data on twiclips.com
*://twiclips.com/*
Read and change your data on dev.twiclips.com
*://dev.twiclips.com/
Read and change your data on clips.twitch.tv
*://clips.twitch.tv/*
Read and change your data on www.twitch.tv
*://www.twitch.tv/*
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Twiclips - Twitch Clip Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ip-api.comwidely used
Twiclips - Twitch Clip Downloader sends data to ip-api.com. A widely used service: 62 other extensions we have analysed send data here.
- ipinfo.iowidely used
Twiclips - Twitch Clip Downloader sends data to ipinfo.io. A widely used service: 45 other extensions we have analysed send data here.
- hawkeye-us.us-west-1.log.aliyuncs.com
Twiclips - Twitch Clip Downloader sends data to hawkeye-us.us-west-1.log.aliyuncs.com. 18 other extensions we have analysed send data here.