Is VK AD SKIP — пропуск рекламных сегментов внутри видео VK safe?

Medium risk

VK AD SKIP sends VK video viewing details and account identifiers to vkadskip-api.star-tech.dev.

When a VK or VK Video page loads videos, the extension reads the viewer's VK account ID and its own persistent extension UUID. For each video it processes, it sends the video ID, duration, VK account ID, and extension UUID to vkadskip-api.star-tech.dev.

gkshinkv2.2.0Chrome Web Store
45Risk
Who publishes it

gkshink - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
gkshink

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

VK video pages send your account ID and viewing data to the developer

Every VK or VK Video page with a playable video sends the video ID, duration, and the extension's own persistent install ID to vkadskip-api.star-tech.dev.

Code analysis shows your VK account ID is read and sent the same way.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a VK or VK Video page that has a playable video.

The extension did this

The extension sends the video ID and duration, its own persistent install ID, and your VK account ID to vkadskip-api.star-tech.dev.

This fires whether or not you have turned off the extension's Sending statistics setting.

Captured request
GEThttps://vkadskip-api.star-tech.dev/video-calculated?v=2.2.0&video_id=-220754053_456246654&duration=6379&user_id=bc36c8e6-6cf6-4035-a8f8-2333ef5c5e52

HTTP 200, JSON array of ad segments to skip for this video.

Parameters sent with every video-calculated request
  • VK account ID
    123456789 (illustrative, not captured live)

    Your real, numeric VK account ID, read from your browser's VK login data.

  • Install ID
    bc36c8e6-6cf6-4035-a8f8-2333ef5c5e52

    A permanent random ID the extension creates once and reuses on every request.

  • Video ID
    -220754053_456246654

    Identifies exactly which VK video you are watching.

  • Video duration
    6379

    The length of the video you are watching, in seconds.

The code that does this

Reading your VK account ID; the statistics toggle is never checked

Readable version

VK account ID extraction

content-scripts/content.js
function extractVkAccountId() {  const direct = localStorage.getItem("userId");  if (direct && direct.trim()) return direct.trim();  for (let i = 0; i < localStorage.length; i++) {    const key = localStorage.key(i);    if (key && key.endsWith(":web_token:login:auth")) {      const raw = localStorage.getItem(key);      if (!raw) continue;      try {        const userId = JSON.parse(raw)?.user_id;        if (userId != null && String(userId).match(/^\d+$/)) return String(userId);      } catch {}    }  }  return null;}

Building the outgoing request parameters

content-scripts/content.js
function attachIdentifyingParams(endpointDef, platformState) {  const params = {};  const placement = endpointDef.contextPlacement ?? "query";  const set = (key, value) => {    if (placement === "body") params.body = { ...params.body, [key]: value };    else params.query = { ...params.query, [key]: value };  };  if (platformState.activePlatform === "vk") {    const vkAccountId = platformState.vk?.vkUserId;    if (vkAccountId) set("vk_user_id", String(vkAccountId));  }  if (new Set(["segments.calculated","segments.create","segments.vote"]).has(endpointDef.key)) {    const installId = persistentSettings.get().userId;    if (installId) set("user_id", String(installId));  }  return params;}
Where this data goes
    • vkadskip-api.star-tech.dev

    The extension developer's own backend. Receives your VK account ID and a persistent install ID with every video you watch, regardless of the statistics setting.

Where it sends data

Destinations our analysis observed VK AD SKIP — пропуск рекламных сегментов внутри видео VK contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • vkadskip-api.star-tech.dev

    VK AD SKIP — пропуск рекламных сегментов внутри видео VK sends data to vkadskip-api.star-tech.dev. No other extension we have analysed sends data here.

Updated 30 September 2026olbhbkoaachepoahjnpfcfbjmmhdcpbn