Techdom & codeChapter 4

Check a tool before you install it

A techdom tool runs on your side of the screen, next to your sign-ins and your saved card. Ten minutes of checking before you install it shows what it can read, what it sends and whether you can stop it.

Entry: T4
Category: Techdom & code
Checked: 3 November 2026
Reading: 7 min
Sections: 6

Evidence

In 30 seconds

In my experience most risky tools aren’t malware. They do what they say, with a hidden price or no way out.
Read the permissions, the addresses it talks to, the updater, the defaults and the stop.
Never test an unknown tool on the computer where you’re signed in.
A check lowers the risk. It never makes an unknown tool safe.
Remote access is a red line, and you can remove a tool you doubt.

You will learn

What a tool can read, send and change once it’s installed.
A ten-minute check, in order, with three small scripts that run for real.
How to word a verdict about a tool without overclaiming.
Which lines to refuse, and what to do if a tool is already installed.
The same checks from the maker’s side.

Don’t trust me, a label or a friendly maker. Spend ten minutes first, and walk away from any tool that won’t let you check. It makes you a lot harder to surprise.

Vivian

Why check at all

A techdom tool runs on your side of the screen, often inside your signed-in browser, next to a saved card. See How techdom tools work for the families.

In my experience the usual danger is a tool that does exactly what it says, with a hidden price or no way out. Malware is the rarer case. So the check covers design (stop, limit, running total, defaults) as well as code (permissions, addresses, updater).

Press describes a scene flooded with scammers who use stolen photos of attractive women. ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026. A free tool offered by a stranger deserves the same doubt as a beautiful profile.

A check lowers the risk, and that’s all it does. Your best protection is the limit you set before you start. See Breaks that hold. If you need a checklist to feel safe, not installing is a fine answer.

A ten-minute check

Do the steps in order. If you can’t do one, that’s your answer.

Ten-minute check

Find the maker. A maker with a history you can check counts, and a persona or a handle counts too. A tool from someone with no history at all has already failed.
Open the permission list and the site list. Write down every line you can’t explain.
List the addresses it talks to and find out who runs each one.
Find the updater. Can it fetch and run new files, and who decides when?
Check the defaults: does it start switched off? Does it show a running total? Is there a limit you set?
Test the stop in every state: idle, running, locked, just after a payment. A stop that fails in one state is a defect.
Compare the file you got with the fingerprint the maker published.
Try it in a virtual machine or a fresh browser profile with none of your sign-ins.

Reading the permissions

When you add an extension, Chrome shows permission warnings that describe what the permissions allow. VerifiedChecked against the original source.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab) Accessed 3 November 2026. Host permissions are what let an extension work with the sites that match its listed patterns. VerifiedChecked against the original source.Declare permissions | Chrome Extensions | Chrome for Developers (opens in a new tab) Accessed 3 November 2026. Some permissions are optional: granted while the extension runs, not at install. VerifiedChecked against the original source.Declare permissions | Chrome Extensions | Chrome for Developers (opens in a new tab) Accessed 3 November 2026.

After install you can open Extensions, then Manage extensions, then a tool’s Details page to see which sites it may access. VerifiedChecked against the original source.Install and manage extensions - Chrome Web Store Help (opens in a new tab) Accessed 3 November 2026. That page has a setting for whether the tool may read and change your data on every website you visit. VerifiedChecked against the original source.Install and manage extensions - Chrome Web Store Help (opens in a new tab) Accessed 3 November 2026.

If an update adds a permission that triggers a warning, Chrome disables the extension until you accept it. VerifiedChecked against the original source.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab) Accessed 3 November 2026. An update that stays within the permissions it already has asks you nothing. The Chrome Web Store requires extensions to disclose how they handle user data, even when it never leaves the device. VerifiedChecked against the original source.Updated Privacy Policy & Secure Handling Requirements | Chrome Web Store - Program Policies | Chrome for Developers (opens in a new tab) Accessed 3 November 2026. A tool you load from a folder skips that listing, so there’s no disclosure to read.

Here are common permissions in my own words. Chrome’s own pages are the reference.

What common permissions let a tool do
Permission	What it lets the tool do	What to ask
tabs	See the address of every open tab	Why does a tool for one site need all of them?
cookies	Read and write cookies	Does it need your sign-in on any site?
webRequest	See every request your browser makes	What does it do with them?
scripting	Insert code into pages	Into which pages, and who wrote that code?
Site access to all websites	Work on every page you open	Can it be limited to the one site it serves?
An update address	Fetch new versions from a server	Who runs it, and can it send any file?

Code you can run

Three short scripts show the idea. Each reads made-up data, opens no network connection and changes nothing on your computer.

Three small checks

manifest_check.py

# manifest_check.py - read an extension manifest the way a stranger would, before installing.
# It reads two invented manifests that sit inside this file. It opens no file and no network.

SAMPLES = {
    "tight": {
        "manifest_version": 3,
        "name": "Example fan tool",
        "permissions": ["storage", "alarms"],
        "host_permissions": ["https://shop.example.test/*"],
        "content_scripts": [{"matches": ["https://shop.example.test/*"], "js": ["main.js"]}],
    },
    "wide": {
        "manifest_version": 3,
        "name": "Example wide tool",
        "permissions": ["storage", "tabs", "cookies", "webRequest", "scripting"],
        "host_permissions": ["<all_urls>"],
        "content_scripts": [{"matches": ["*://*/*"], "js": ["main.js"]}],
        "update_url": "https://updates.example.test/feed.xml",
    },
}

RISKY = {
    "tabs": "sees the address of every tab",
    "cookies": "reads and writes cookies",
    "webRequest": "sees every request",
    "scripting": "injects code into pages",
    "history": "reads browsing history",
    "nativeMessaging": "talks to a program on the computer",
    "clipboardRead": "reads the clipboard",
}
BROAD = {"<all_urls>", "*://*/*", "http://*/*", "https://*/*"}


def review(manifest):
    findings = []
    for permission in manifest.get("permissions", []):
        if permission in RISKY:
            findings.append("permission " + permission + ": " + RISKY[permission])
    patterns = list(manifest.get("host_permissions", []))
    for script in manifest.get("content_scripts", []):
        patterns += script.get("matches", [])
    for pattern in sorted(set(patterns)):
        if pattern in BROAD:
            findings.append("site access " + pattern + ": every website")
    if "update_url" in manifest:
        findings.append("it updates itself from " + manifest["update_url"])
    return findings


for name, manifest in SAMPLES.items():
    findings = review(manifest)
    if findings:
        print(name, "->", len(findings), "finding(s) to explain before installing")
    else:
        print(name, "->", "no broad access found (the code is still unread)")
    for line in findings:
        print("  -", line)

Outputpython manifest_check.py

tight -> no broad access found (the code is still unread)
wide -> 7 finding(s) to explain before installing
  - permission tabs: sees the address of every tab
  - permission cookies: reads and writes cookies
  - permission webRequest: sees every request
  - permission scripting: injects code into pages
  - site access *://*/*: every website
  - site access <all_urls>: every website
  - it updates itself from https://updates.example.test/feed.xml

host_report.py

# host_report.py - group a list of request addresses by host and label each host,
# to answer "who does this page or tool talk to?" before trusting it.
# The addresses are invented and sit in this file. Nothing is fetched.
from collections import Counter

KNOWN = {
    "app.example.test": "the tool's own server",
    "cdn.example.test": "the tool's own server",
    "metrics.tracker.test": "analytics",
}

requests = [
    "https://app.example.test/page",
    "https://app.example.test/api/items",
    "https://cdn.example.test/img/1.png",
    "https://cdn.example.test/img/2.png",
    "https://metrics.tracker.test/collect",
    "https://mystery.host.test/x.js",
]


def host_of(address):
    return address.split("//", 1)[1].split("/", 1)[0]


counts = Counter(host_of(address) for address in requests)
for host, count in counts.most_common():
    print(count, "|", host, "|", KNOWN.get(host, "UNKNOWN: find out who runs it before trusting it"))

Outputpython host_report.py

2 | app.example.test | the tool's own server
2 | cdn.example.test | the tool's own server
1 | metrics.tracker.test | analytics
1 | mystery.host.test | UNKNOWN: find out who runs it before trusting it

pinned_hash.py

# pinned_hash.py - compare a file against the fingerprint its author published.
# The "file" is a few bytes inside this script, so nothing is downloaded or opened.
import hashlib

published = hashlib.sha256(b"the file the author released").hexdigest()


def matches(data):
    return hashlib.sha256(data).hexdigest() == published


for label, data in [
    ("the file you got, same bytes", b"the file the author released"),
    ("the file you got, one byte added", b"the file the author released!"),
]:
    print(label, "->", "same as published" if matches(data) else "different: do not run it")

Outputpython pinned_hash.py

the file you got, same bytes -> same as published
the file you got, one byte added -> different: do not run it

The fingerprint in the last script is computed inside it. In real life you copy it from the maker’s page and compare.

They show a method. They don’t give a verdict. A manifest check can’t see what the code does, and a matching fingerprint only proves you hold the file the maker published.

What a check can’t tell you

A verdict has two parts: what the check found, and what it didn’t cover.

Words for a verdict

Malicious today
The tool does harm now. Only say this after reading the whole source, and with the evidence.
Not malicious today, able to become so with one update
Nothing harmful runs now, but an update could change that, for example when the updater can fetch any file and your sign-ins sit on the same computer. Serious, but not malware.
Harmless in code, unsafe in use
Nothing hidden is harmful, but the defaults expose you: a machine identifier sent from your names, a safety-word or quick-exit off by default.
Not checked
You didn’t read it, or couldn’t. Treat it as unsafe for any computer that holds your sign-ins.

For a made-up example of a first alarm and a fuller reading, see Fake tools.

Scrambled code doesn’t prove bad intent, because makers scramble code to stop people copying it. It does mean you can’t verify the tool, and you shouldn’t take a tool that holds a signed-in session on trust.

Myth
No malware was found, so the tool is safe.
Fact
A tool can do exactly what it says and still hide its price or give you no way out. Check the design as well as the code.
Myth
The maker says it’s safe, so it’s safe.
Fact
A friendly label proves nothing. Trust is the one thing a spending tool shouldn’t need.
Myth
An assistant read the code and found nothing, so it passed an audit.
Fact
An assistant can miss logic hidden in scrambled code. A summary isn’t an audit.

Red flags and the red line

These lines come from the person offering the tool or the session. The answer is yours.

What you may hear, and the answer
What they say or do	The counter
It’s safe, I made it myself.	That’s a claim until someone checks it. The same list applies to every tool, including one made by Vivian.
Install this zip, the store would never allow it.	It skips the store’s review. Read its stated limits and expect to remove it.
Send me the code on your phone, or your password, so I can set it up.	Never. A real dom doesn’t need your password, your login code or your connection code.
There’s no stop, it ends when it ends.	Walk away. A stop that depends on your willpower is no stop. Closing the program always works, but don’t build your safety on it.
Test it with real money first, one test can’t hurt.	A tiny amount you chose, a test account or a recording. Never open-ended.
Open a session and I’ll do it for you, or let me read your chats myself.	Say no, and offer nothing from your accounts or your chats. If a session is already open, close it and change your passwords from another device.

Remote access

A remote-session hands your computer to someone else: files, saved passwords and screens. A US government alert advises people not to give control of their computers or mobile devices to any stranger. VerifiedChecked against the original source.IC3 Issues Alert on Tech Support Fraud (opens in a new tab) Accessed 3 November 2026. A remote-access vendor tells users not to give device access to people they do not know or trust. VerifiedChecked against the original source.TeamViewer and scamming (opens in a new tab) Accessed 3 November 2026. More on the risks in Fake tools.

A dom asks for a session

A dom asks you to open a remote session so she can read your messages. She says it’ll take a minute.

If you already installed it

A tool that stays installed is an ongoing risk: its maker can push a harmful update later. Removing it is the simplest way out.

On Windows, uninstall from Settings, then Apps, then Installed apps. VerifiedChecked against the original source.Uninstall or remove apps and programs in Windows | Microsoft Support (opens in a new tab) Accessed 3 November 2026. Some apps can’t be removed there. VerifiedChecked against the original source.Uninstall or remove apps and programs in Windows | Microsoft Support (opens in a new tab) Accessed 3 November 2026. To stop one starting with the computer, switch it off in Settings, Apps, Startup, or in Task Manager’s Startup tab. VerifiedChecked against the original source.Configure Startup applications in Windows | Microsoft Support (opens in a new tab) Accessed 3 November 2026. You remove a browser extension from the Manage extensions page.

If a tool you doubt is installed

Stop it. Close the program, or turn the computer off. That always works.
Remove it, and remove its browser extension too.
Sign out everywhere it could reach, then change those passwords from a different computer.
Check your order history and bank statement for sends you didn’t choose.
Set a limit or an alert at your bank.
If money left that you didn’t mean to send, go to If you already sent. If stopping feels hard, go to Where to get help.

Check it

Every claim with its evidence level and its sources.

Evidence levels

Verified: Checked against the original source.
Reported: Stated by a serious secondary source read in full.
Community: Widely said in the scene; no document proves it.
Vivian’s field notes: First-hand experience, not a study.
Unverified: Plausible, not proven yet.

A techdom tool runs on your side of the screen, often inside your signed-in browser, next to a saved card.
Malware is the rarer case.
Press describes a scene flooded with scammers who use stolen photos of attractive women.
ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026.Financial Domination Has a Scamming Problem (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A free tool offered by a stranger deserves the same doubt as a beautiful profile.
Your best protection is the limit you set before you start.
If you need a checklist to feel safe, not installing is a fine answer.
I never run an unknown program on the computer where I’m signed in. A throwaway setup costs time, and that’s cheap next to a drained card.
When you add an extension, Chrome shows permission warnings that describe what the permissions allow.
VerifiedChecked against the original source.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab) Accessed 3 November 2026.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
Host permissions are what let an extension work with the sites that match its listed patterns.
VerifiedChecked against the original source.Declare permissions | Chrome Extensions | Chrome for Developers (opens in a new tab) Accessed 3 November 2026.Declare permissions | Chrome Extensions | Chrome for Developers (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
Some permissions are optional: granted while the extension runs, not at install.
VerifiedChecked against the original source.Declare permissions | Chrome Extensions | Chrome for Developers (opens in a new tab) Accessed 3 November 2026.Declare permissions | Chrome Extensions | Chrome for Developers (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
After install you can open Extensions, then Manage extensions, then a tool’s Details page to see which sites it may access.
VerifiedChecked against the original source.Install and manage extensions - Chrome Web Store Help (opens in a new tab) Accessed 3 November 2026.Install and manage extensions - Chrome Web Store Help (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
That page has a setting for whether the tool may read and change your data on every website you visit.
VerifiedChecked against the original source.Install and manage extensions - Chrome Web Store Help (opens in a new tab) Accessed 3 November 2026.Install and manage extensions - Chrome Web Store Help (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026

Show all 44 claims

If an update adds a permission that triggers a warning, Chrome disables the extension until you accept it.
VerifiedChecked against the original source.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab) Accessed 3 November 2026.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
An update that stays within the permissions it already has asks you nothing.
The Chrome Web Store requires extensions to disclose how they handle user data, even when it never leaves the device.
VerifiedChecked against the original source.Updated Privacy Policy & Secure Handling Requirements | Chrome Web Store - Program Policies | Chrome for Developers (opens in a new tab) Accessed 3 November 2026.Updated Privacy Policy & Secure Handling Requirements | Chrome Web Store - Program Policies | Chrome for Developers (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A tool you load from a folder skips that listing, so there’s no disclosure to read.
Chrome’s own pages are the reference.
A manifest check can’t see what the code does, and a matching fingerprint only proves you hold the file the maker published.
A verdict has two parts: what the check found, and what it didn’t cover.
Only say this after reading the whole source, and with the evidence.
Serious, but not malware.
Nothing hidden is harmful, but the defaults expose you: a machine identifier sent from your names, a safety-word or quick-exit off by default.
Treat it as unsafe for any computer that holds your sign-ins.
It does mean you can’t verify the tool, and you shouldn’t take a tool that holds a signed-in session on trust.
Check the design as well as the code.
Trust is the one thing a spending tool shouldn’t need.
A summary isn’t an audit.
A remote-session hands your computer to someone else: files, saved passwords and screens.
A US government alert advises people not to give control of their computers or mobile devices to any stranger.
VerifiedChecked against the original source.IC3 Issues Alert on Tech Support Fraud (opens in a new tab) Accessed 3 November 2026.IC3 Issues Alert on Tech Support Fraud (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A remote-access vendor tells users not to give device access to people they do not know or trust.
VerifiedChecked against the original source.TeamViewer and scamming (opens in a new tab) Accessed 3 November 2026.TeamViewer and scamming (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A tool that stays installed is an ongoing risk: its maker can push a harmful update later.
On Windows, uninstall from Settings, then Apps, then Installed apps.
VerifiedChecked against the original source.Uninstall or remove apps and programs in Windows | Microsoft Support (opens in a new tab) Accessed 3 November 2026.Uninstall or remove apps and programs in Windows | Microsoft Support (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
Some apps can’t be removed there.
VerifiedChecked against the original source.Uninstall or remove apps and programs in Windows | Microsoft Support (opens in a new tab) Accessed 3 November 2026.Uninstall or remove apps and programs in Windows | Microsoft Support (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
To stop one starting with the computer, switch it off in Settings, Apps, Startup, or in Task Manager’s Startup tab.
VerifiedChecked against the original source.Configure Startup applications in Windows | Microsoft Support (opens in a new tab) Accessed 3 November 2026.Configure Startup applications in Windows | Microsoft Support (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
You remove a browser extension from the Manage extensions page.
I treat a signed-in session like a password. Whoever holds it acts as you, and a two-step login doesn’t help once the session is taken. After a tool I doubt, I sign out everywhere as well as changing the password.
If you build tools, your users should be able to do every check above.
Leftover handles point to your accounts.
Check the licence of every third-party part and ship it next to the part.
Send access keys privately and make them revocable.
A build step can change behaviour.
Publish what the tool sends and to whom, write a plain readme, and test the stop in every state by trying to break it.
A tool described by its own maker, including a tool made by Vivian, is a claim until someone else has checked it.
Chrome disables the extension until the user accepts.
VerifiedChecked against the original source.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab) Accessed 3 November 2026.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026

Download

Check a tool before you install it
PDF

This wiki is for adults.

Check a tool before you install it

In 30 seconds

You will learn

Why check at all

A ten-minute check

Ten-minute check

Reading the permissions

Code you can run

Three small checks

What a check can’t tell you

Words for a verdict

Malicious today

Not malicious today, able to become so with one update

Harmless in code, unsafe in use

Not checked

Red flags and the red line

Remote access

A dom asks for a session

If you already installed it

If a tool you doubt is installed

For makers: the same list from the other side

Check yourself

Remember it

Check it

Evidence levels

Download

Check a tool before you install it