Tracks Amazon prices, monitors orders, scrapes reviews, fetches order details, drafts refund messages, and manages refund cases efficiently.

This extension contains code to scrape Amazon pages, take screenshots, store artifacts locally, and call a configurable LLM endpoint using an API key you provide in the UI. Before installing: (1) only proceed if you trust the extension source — the package requests wide host permissions (<all_urls>) which allows injection and data reading on any page, not just Amazon; (2) do not paste your primary OpenAI (or other) API key into the panel unless you trust the endpoint and author — prefer a dedicated, limited-scope key; (3) inspect the extension code yourself (or ask someone to) to confirm there are no outbound data exfiltration calls beyond the planner fetch; (4) if you must use it, restrict the endpoint to the official provider URL (e.g., api.openai.com) and consider revoking the key after use; (5) prefer an alternative that limits host_permissions to Amazon domains. These mismatches (broad permissions + ability to send scraped data to an external LLM) are the reason this package is flagged as suspicious.

Package: EasyBuy Agent Demo (xpi) Version: 0.1.0 Description: MV3 Agent demo: panel -> SW -> CS -> tool -> result -> panel The EasyBuy Agent Demo is a browser extension designed for automating tasks, particularly on Amazon, by integrating with an external AI model. It requests broad permissions, including `<all_urls>` and `scripting`, which grant it significant control over web content and browser actions. The core logic involves an AI generating a sequence of 'tool calls' (browser actions or predefined 'skills') based on user input. These tool calls are then executed by a background service worker and a content script. Crucially, the extension implements a robust user confirmation mechanism: every single browser action proposed by the AI requires explicit user approval via the side panel before it is executed. This mechanism, combined with a whitelist of allowed browser tools and hardcoded expansions for higher-level 'skills', acts as a strong safeguard against malicious or unintended actions. While the permissions are extensive, they are necessary for its stated purpose of browser automation, and the user remains in ultimate control of each step. The user's OpenAI API key is stored locally within the browser's storage, and generated artifacts like screenshots are stored in IndexedDB.