Is VK AD SKIP — пропуск рекламных сегментов внутри видео VK safe?
VK AD SKIP sends VK video viewing details and account identifiers to vkadskip-api.star-tech.dev.
When a VK or VK Video page loads videos, the extension reads the viewer's VK account ID and its own persistent extension UUID. For each video it processes, it sends the video ID, duration, VK account ID, and extension UUID to vkadskip-api.star-tech.dev.
Who publishes itgkshink - no other listings under this identity
gkshink - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
VK video pages send your account ID and viewing data to the developer
Every VK or VK Video page with a playable video sends the video ID, duration, and the extension's own persistent install ID to vkadskip-api.star-tech.dev.
Code analysis shows your VK account ID is read and sent the same way.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a VK or VK Video page that has a playable video.
The extension sends the video ID and duration, its own persistent install ID, and your VK account ID to vkadskip-api.star-tech.dev.
This fires whether or not you have turned off the extension's Sending statistics setting.
HTTP 200, JSON array of ad segments to skip for this video.
- VK account ID123456789 (illustrative, not captured live)
Your real, numeric VK account ID, read from your browser's VK login data.
- Install IDbc36c8e6-6cf6-4035-a8f8-2333ef5c5e52
A permanent random ID the extension creates once and reuses on every request.
- Video ID-220754053_456246654
Identifies exactly which VK video you are watching.
- Video duration6379
The length of the video you are watching, in seconds.
Reading your VK account ID; the statistics toggle is never checked
VK account ID extraction
content-scripts/content.jsfunction extractVkAccountId() { const direct = localStorage.getItem("userId"); if (direct && direct.trim()) return direct.trim(); for (let i = 0; i < localStorage.length; i++) { const key = localStorage.key(i); if (key && key.endsWith(":web_token:login:auth")) { const raw = localStorage.getItem(key); if (!raw) continue; try { const userId = JSON.parse(raw)?.user_id; if (userId != null && String(userId).match(/^\d+$/)) return String(userId); } catch {} } } return null;}Building the outgoing request parameters
content-scripts/content.jsfunction attachIdentifyingParams(endpointDef, platformState) { const params = {}; const placement = endpointDef.contextPlacement ?? "query"; const set = (key, value) => { if (placement === "body") params.body = { ...params.body, [key]: value }; else params.query = { ...params.query, [key]: value }; }; if (platformState.activePlatform === "vk") { const vkAccountId = platformState.vk?.vkUserId; if (vkAccountId) set("vk_user_id", String(vkAccountId)); } if (new Set(["segments.calculated","segments.create","segments.vote"]).has(endpointDef.key)) { const installId = persistentSettings.get().userId; if (installId) set("user_id", String(installId)); } return params;}- vkadskip-api.star-tech.dev
The extension developer's own backend. Receives your VK account ID and a persistent install ID with every video you watch, regardless of the statistics setting.
Where it sends data
Destinations our analysis observed VK AD SKIP — пропуск рекламных сегментов внутри видео VK contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- vkadskip-api.star-tech.dev
VK AD SKIP — пропуск рекламных сегментов внутри видео VK sends data to vkadskip-api.star-tech.dev. No other extension we have analysed sends data here.