Is YouTube AdSkipper safe?

Medium risk

YouTube AdSkipper sends the signed-in Chrome profile ID and ad-skip counter to api.markgurney.dev.

When YouTube pages finish loading and after ads are skipped, the extension asks Chrome for the signed-in profile ID. It sends that ID as a query parameter with the local ads-skipped counter in a POST request to api.markgurney.dev.

Markv1.1.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Every YouTube video load sends your Chrome account ID off your device

Every time you open a matched YouTube or Chrome docs page, the extension's service worker reads your signed-in Chrome account ID and posts it, with your ad-skip count, to api.markgurney.dev.

No consent prompt appears.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a YouTube video page or a Chrome extension developer docs page.

The page matches one of the extension's four URL patterns.

The extension did this

The extension's background service worker reads your signed-in Chrome account ID and sends it to api.markgurney.dev.

This happens automatically, with no consent prompt or visible indicator.

Captured request
POSThttps://api.markgurney.dev/adskip/update?user=118054234670268912501

Server returned HTTP 400 because this test profile's local ad-skip counter had never been set; the account ID itself had already been sent regardless of that response.

Headers
Content-Type
application/json
Body
{  "ads_skipped": null}
What the request sends
  • Chrome account ID
    118054234670268912501

    A stable ID tied to whichever Google account is signed into Chrome. It lets the server recognize you across every visit.

  • Ads skipped count
    7 (illustrative; our test profile's counter was still empty)

    How many ads the extension has counted itself skipping for you. It travels in the same request as your account ID.

Where the data goes
    • api.markgurney.dev

    Receives your Chrome account ID and ad-skip count on every matched page load. Not a Google or YouTube domain.

What it can do

Permissions this extension asks for, as declared in version 1.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Where it sends data

Destinations our analysis observed YouTube AdSkipper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.markgurney.dev

    YouTube AdSkipper sends data to api.markgurney.dev. No other extension we have analysed sends data here.

Updated 30 September 2026ipenehognpepmfokjeckpbenhjfchcfd