Why the extension needs permissions
tabs identifies website tabs; scripting runs bundled adapters in a selected document; storage keeps connection state and write deduplication records; alarms maintain the connection. The built extension declares the supported website domains and local connection permissions.
The current site scope covers the relevant Reddit, Zhihu, X and WhatsApp domains. Browser execution is constrained by extension permissions and the site registry. This does not make page content trustworthy. Do not expose the bridge to the public internet.
Local connection and document binding
The bridge listens only on 127.0.0.1. The extension uses a fixed extension Origin, and the local HTTP control interface uses generated authentication data. That value is not sent to AI or exchanged manually by the user.
Targets are bound to a tab, URL, and browser document identifier. Navigation or document replacement may invalidate an operation and require fresh context. Schemas validate arguments. Execution code ships in the local extension rather than being downloaded and run remotely.
These controls do not defend against malware that already controls your device, browser, or AI client. Protect your local account and installation folders and install trusted releases.
Website text is not an instruction
Posts, comments, private messages, and page bodies are untrusted input. They may try to redirect AI, disclose information, or trigger unrelated actions. AI should treat that text as material to process, not as user authorization.
Compact results, source links, and discovery guidance help communicate this boundary, but do not provide complete prompt-injection protection. The client must still separate user instructions, website content, and tool authority.
Writes, cancellation, and uncertainty
Only user-requested interactions should run. The extension adds no confirmation window and does not automatically retry writes. Recent write request IDs help prevent replay of the same request after reconnection.
Cancellation affects unfinished local work; it cannot undo an operation already received by the website. After WRITE_UNCONFIRMED, timeout, disconnection, or navigation, inspect the website before retrying. A newly generated retry request is not an undo mechanism.
Report a vulnerability
Privately email [email protected] with the version, impact, and a minimal reproduction without sensitive data. Do not publish usable credentials, user information, or full details of an unresolved exploit in a public issue.
Maintainers assess reports as resources allow. There is no promised response time, bounty, or authorization for testing beyond what has been agreed. Use your own accounts and isolated environments, avoid others’ data, and do not perform destructive tests.