Is キーゾンv3 safe?

Medium risk

キーゾンv3 is medium risk. On Amazon, Amazon Japan, and Keepa pages, the content script finds a product ID and Keepa API key, posts them to koubou3.com, and assigns the response fields sold and hist into page HTML sinks, so returned markup becomes part of the page.

sedori koubouv3.0.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote HTML inserted into Amazon and Keepa pages

On Amazon, Amazon Japan, and Keepa pages, the content script finds a product ID and Keepa API key, posts them to koubou3.com, and assigns the response fields sold and hist into page HTML sinks, so returned markup becomes part of the page.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a supported Amazon or Keepa product page.

The content script is declared for Amazon, Amazon Japan, and Keepa and runs at document start.

The extension did this

The extension asks koubou3.com for product markup and inserts the returned HTML into the page.

The server response fields are assigned to variables and then written through `.html()`, `.after()`, and `.append()`.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://koubou3.com/keezon/
The source expects a JSON response containing HTML-bearing `sold` and `hist` fields.
03EvidenceFIELD TABLE
Fields handled by the request and response path
FieldValueWhy it matters
Product identifier
asin=B08N5WRWNW (illustrative)This identifies which Amazon or Keepa product page you are viewing.
Marketplace selector
k_country_i=5 for Japan, k_country_i=1 for USThis tells the service whether the page belongs to Amazon Japan or Amazon US.
Saved Keepa API key
key=abcd1234efgh5678 (illustrative)This sends the API key you saved in the extension options to the extension's service.
Filter setting
filter=1 (illustrative)This carries the extension option that changes what product information is requested.
Returned sales panel HTML
sold=<div class='keezon_sold'>sales panel markup</div> (illustrative)This markup is inserted into the current shopping page and controls what appears in the extension's product panel.
Returned history HTML
hist=<div class='keezon_hist'>history panel markup</div> (illustrative)This markup is inserted on Keepa product pages as the extension's history section.
04EvidenceCODE COMPARE
The code that does this

The remote response flows into HTML-writing sinks

What it actually does
Readable data flow from response fields to page HTMLscript.js
$.ajax({
  type: 'POST',
  url: 'https://koubou3.com/keezon/',
  dataType: 'json',
  data: {
    asin: asin,
    k_country_i: k_country_i,
    key: e.apikey,
    filter: e.filter
  },
  success: function(data) {
    var salesPanelHtml = data.sold;
    var historyPanelHtml = data.hist;

    if (document.querySelector('#keezon_sold') != null) {
      $('#keezon_sold').html(salesPanelHtml);
    } else {
      $(targetID).after(
        "<div style='min-width: 935px; max-width: 1320px;' id='keezon_sold'>" +
        salesPanelHtml +
        "</div>"
      );
    }

    if (mode1 !== -1) {
      if (document.querySelector('#keezon_hist') != null) {
        $('#keezon_hist').html(historyPanelHtml);
      } else {
        $('#casinLine').append(
          "<div id='keezon_hist'>" + historyPanelHtml + "</div>"
        );
      }
    }

    var height = document.body.clientHeight;
    window.parent.postMessage(height + 100, '*');
  }
});
05EvidenceCODE COMPARE
The code that does this

The content script is loaded on the affected sites

What it actually does
Readable manifest scopemanifest.json
content_scripts: [{
  matches: [
    'https://keepa.com/*',
    'https://www.amazon.co.jp/*',
    'https://www.amazon.com/*'
  ],
  js: ['jquery.min.js', 'script.js'],
  run_at: 'document_start',
  all_frames: true
}]
06EvidenceTHIRD PARTY LIST
External service in the verified path
  • koubou3.com

    Receives the product identifier, marketplace selector, saved Keepa API key, and filter option; returns the HTML strings later written into the page.

Updated 17 September 2026omnpnodbhognoblgbjmlagejkioccpih