Method
Tiers
Capability0-1516-3536-6061+
Other axes0-910-2425-4950+
Hard fails
On a known-malware list
Updates from outside the store
Runs code it downloads
Strips page security headers
Obfuscated code with network calls
Signature fails
Capability optional permissions count half
30Proxy, debugger, vPN provider, all sites
20Native app messaging, sign-in proxy
15Cookies, manages extensions, privacy settings, screen capture, user scripts, rewrites responses, many sites
10Scripting, web requests, history, browsing data, clipboard read, page capture, tab capture, content settings, certificates, platform keys, security modules, cookies + all sites, any site can message it
5Tabs, identity, account email, navigation, downloads, opens downloads, location, sessions, network rules, network rule matches, answers sign-in prompts, processes, dNS lookups, finds page text, browser settings, accessibility settings, some sites, early page script, manifest V2
3Bookmarks, top sites, reading list, search, tab groups, containers, accessibility settings
0Storage, alarms, notifications, active tab, menus and other permissions with no reach
?Unknown permission goes to Review
Code
20Obfuscated code
15Code built from data, turns off extensions, allows remote scripts
10Sets the proxy, reads all cookies, rewrites headers
5Binary code, live secret in code
5-15Library with a known flaw, by its worst flaw
Reputation users, ratings and badges never score
60Removed from the store
40Listed suspicious
30Gone from the store
10No privacy policy
5Not a trader, free email, no website
Change coming later
Each check is a first review for now. Later versions compare against the version you approved.