Is Zent Translate safe?
Zent Translate is low risk. When you use the AI slash-command in Zoho Mail, the content script sends your prompt, page title, and URL to the background worker, which posts them to zenttranslate.com/api/ai-agent/chat. These can describe the mailbox thread or folder.
Who publishes itzenttranslate - 1 other listing from the same operator, none carrying a finding
zenttranslate - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 20k+ users between them, none of them carrying a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Zoho Mail slash command sends email page context
When you use the AI slash-command in Zoho Mail, the content script sends your prompt, page title, and URL to the background worker, which posts them to zenttranslate.com/api/ai-agent/chat.
These can describe the mailbox thread or folder.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You invoke the AI slash-command feature while on Zoho Mail.
The extension sends your typed prompt together with the page title and page URL to Zent Translate.
Those page fields can identify the mailbox view, folder, thread, or subject visible in the tab.
- Typed prompt/summarize this renewal email
Contains the text you entered for the AI slash command.
- Email page URLhttps://mail.zoho.com/zm/#mail/folder/inbox/p/1699483512457000001
Can reveal which Zoho Mail view or message thread was open when you used the command.
- Email page titleInbox - Project status update - Zoho Mail
Can include the mailbox folder or subject text visible in the browser tab.
- Request modeslash-command
Marks the request as coming from the slash-command feature.
- Content-Type
- application/json
Zoho Mail content script and background fetch path
Readable doAiChat() sends typed text, title, and URL to the background port
content-scripts/slash-command-iframe.js async doAiChat(a, r, l) { this.aiAbortController?.abort(), this.aiAbortController = new AbortController, this.updateState({ isActive: !0, command: r, targetLanguage: il, query: a, position: l, isLoading: !0, error: null, result: null, candidates: [], selectedIndex: 0, isAiCommand: !0, aiResponse: "" }); try { const s = chrome.runtime.connect({ name: "ai-slash-chat" }); let f = ""; const p = this.aiAbortController.signal; await new Promise((h, g) => { const y = () => { s.disconnect(), g(new Error("aborted")) }; p.addEventListener("abort", y, { once: !0 }), s.onMessage.addListener(T => { T.type === "chunk" ? (f += T.text, this.currentTrigger?.query === a && this.updateState({ isLoading: !1, aiResponse: f })) : T.type === "done" ? (p.removeEventListener("abort", y), h()) : T.type === "error" && (p.removeEventListener("abort", y), g(new Error(T.error || "AI request failed"))) }), s.onDisconnect.addListener(() => { p.removeEventListener("abort", y), f ? h() : g(new Error("Connection lost")) }), s.postMessage({ messages: [{ role: "user", content: a }], pageTitle: document.title, pageUrl: location.href }) }), this.currentTrigger?.query === a && this.updateState({ isLoading: !1, aiResponse: f }), ws(_s.SLASH_COMMAND_USED, { command: r, target_language: "ai", input_type: "ai-chat", char_count: a.length, hostname: location.hostname }) } catch (s) { if (s.message === "aborted" || this.currentTrigger?.query !== a) return; let f = s.message || "AI request failed"; s.message === "unauthorized" ? f = "Please login to use AI" : s.message === "quota_exceeded" && (f = "Daily AI limit reached"), this.updateState({ isLoading: !1, error: f }) } }Readable background listener posts the fields to Zent Translate
background.js }), chrome.runtime.onConnect.addListener(h => { h.name === "ai-slash-chat" && h.onMessage.addListener(async w => { try { const O = await fetch(`${a}/api/ai-agent/chat`, { method: "POST", headers: { "Content-Type": "application/json" }, credentials: "include", body: JSON.stringify({ messages: w.messages, pageTitle: w.pageTitle, pageUrl: w.pageUrl, mode: "slash-command" }) }); if (!O.ok) { const P = await O.json().catch(() => ({})); O.status === 401 ? h.postMessage({ type: "error", error: "unauthorized" }) : O.status === 429 && P.error === "quota_exceeded" ? h.postMessage({ type: "error", error: "quota_exceeded" }) : h.postMessage({ type: "error", error: P.error || `Request failed (${O.status})` }); return } if (!O.body) { h.postMessage({ type: "error", error: "No response body" }); return } const N = O.body.getReader(), L = new TextDecoder;- www.zenttranslate.com
Receives the AI slash-command POST containing typed prompt text plus Zoho Mail page title and URL.