Is Youtube Video Skip Ad Trigger safe?

Medium risk

Youtube Video Skip Ad Trigger sends each YouTube URL you visit to Google Analytics, tied to a persistent per-user UUID.

On every YouTube page load, the extension posts a Google Analytics hit containing the full page URL and a UUID stored in sync storage, linking your browsing activity to a stable identifier across sessions. When an ad-skip fires, an additional event with the same UUID and page URL is sent to the extension developer's GA property. The extension also fetches a remotely-controlled list of CSS selectors from Firebase and uses them to auto-click elements on YouTube pages, meaning the set of clicked targets can be changed by the developer at any time.

010pixelv2.4.8Chrome Web Store
45Risk
Who publishes it

010pixel - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
010pixel

Same store account

1 other listing published from this account, 9k+ users between them, none of them carrying a finding.

Easy Mute9k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Firebase selector list controls YouTube auto-clicks

MediumunwantedCWE-829Dynamic sandbox

When you open YouTube, the extension fetches a selector list from rex-moji.firebaseio.com and adds the values to its click targets.

What actually happens

You did this

You open a YouTube page while the extension is enabled.

The extension registers js/myapp.js as a content script on all youtube.com frames.

The extension did this

The page script fetches a Firebase selector list and clicks YouTube elements that match its combined selector list.

Dynamic analysis observed the Firebase request returning .ytp-skip-ad-button.

Concrete values used by the auto-click path

  • Selector source
    https://rex-moji.firebaseio.com/youtube-skip-ad-trigger-classes.json

    Shows where the extension gets extra click targets before interacting with the YouTube page.

  • Returned selector
    .ytp-skip-ad-button

    Tells the extension which matching YouTube page element can be clicked.

  • Saved click targets
    youtube_ad_skip_trigger_skip_btn_classes: [".ytp-skip-ad-button"]

    Lets the extension reuse server-returned selectors alongside its built-in YouTube selectors.

  • Clicked page element
    button.ytp-skip-ad-button

    A matching YouTube element can be clicked for you according to the extension's timing setting.

Captured request

GEThttps://rex-moji.firebaseio.com/youtube-skip-ad-trigger-classes.json

Observed during dynamic analysis: the content-script request returned the JSON string .ytp-skip-ad-button.

What's stored on your device

This stores the selector returned by Firebase so it can be added to the list of YouTube elements the extension may click.

Location
chrome.storage.sync key youtube_ad_skip_trigger_skip_btn_classes
Contents
{  "youtube_ad_skip_trigger_skip_btn_classes": [    ".ytp-skip-ad-button"  ]}

The code that does this

The shipped code fetches selectors, stores them, then clicks matches

Readable version

Readable selector click loop

js/myapp.js
function u() {  var e, t = [".videoAdUiSkipButton.videoAdUiAction.videoAdUiFixedPaddingSkipButton", ".ytp-ad-skip-button", ".ytp-skip-ad-button", ".ytp-ad-overlay-close-button", ".ytp-ad-skip-button-modern", ...s];  for (e in t) ! function(_) {    b("Its " + o), !1 !== h(_) && (b("Skipping Ad in 1 seconds for: " + _), setTimeout(function() {      if (!1 !== h(_)) {        var e = 1,          e = ("skip_immediately" === p ? e = 300 : "skip_after_30_secs" === p ? e = 3e4 : "skip_after_60_secs" === p && (e = 6e4), b("Skipping in: " + e), setTimeout(function() {            document.querySelector(_) && document.querySelector(_).click()          }, e), e = ".ytp-ad-button-text", 0 != document.querySelectorAll(e).length && document.querySelector(e).innerText, e = _, {            t: "event",            ec: k + " " + (y.installType || "development"),            ea: "Skip button clicked",            el: "Skip button class: " + (e || "")          });        if ("on" === g) {          b("GA", e.t);          var t, n, o = m || " ",            i = v || "",            s = "Background Page: " + (v || ""),            a = y.name + " - " + v,            r = Math.random().toString().replace("0.", ""),            c = window.location.hostname,            u = window.location.host,            d = window.location.href,            o = {              v: "1",              tid: "UA-57562361-4",              cid: o,              ds: i,              z: r,              t: "pageview",              aip: "1",              npa: "1",              dl: d,              dh: u,              dp: c,              dt: s,              an: a,              aid: c,              av: y.version            },            i = Object.assign(o, e || {}),            l = [];          i.ev && i.ev !== parseInt(i.ev) && delete i.ev;          for ([t, n] of Object.entries(i)) l.push(t + "=" + n);          r = l.join("&");          try {            var f = new XMLHttpRequest;            f.open("POST", "https://www.google-analytics.com/collect", !0), f.send(r), b("Sent:", i), b("Sent:", r)          } catch (e) {            b("Error sending report to Google Analytics.\n" + e)          }        }      }    }, 100))  }(t[e])}

Readable selector fetch and storage

js/myapp.js
(async function() {  const e = await fetch("https://rex-moji.firebaseio.com/youtube-skip-ad-trigger-classes.json"),    t = await e.json(),    n = (t || "").split(",").map(e => e.trim());  a.storage.sync.set({    youtube_ad_skip_trigger_skip_btn_classes: n  }, function() {    n.forEach(e => {      s.includes(e) || s.push(e)    })  })})()

Remote endpoint involved in the selector update

    • rex-moji.firebaseio.com

    Firebase Realtime Database host that returns the selector string consumed by the YouTube page script.

What it can do

Permissions this extension asks for, as declared in version 2.4.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on youtube.com

    *://*.youtube.com/*

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed YouTubSkipAd contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    YouTubSkipAd sends data to www.google-analytics.com. A widely used service: 388 other extensions we have analyzed send data here.

  • rex-moji.firebaseio.com

    YouTubSkipAd sends data to rex-moji.firebaseio.com. No other extension we have analyzed sends data here.

Updated 30 September 2026hpnelpabemhjfjgiibgkliipaehnfcjk