All source code reflects a coherent, legitimate Korean security extension: extracts statistical features locally; runs a bundled CatBoost ONNX model for inference; classifies images with the library entirely on-device. Server communication (blocklist query to `[domain withheld] and URL-log POST to `[domain withheld] with Google identity) goes exclusively to the publisher's own first-party domain, and both data categories (web history + PII) are explicitly disclosed in the CWS listing. Two hygiene issues worth flagging: the listing markets 'on-device AI without external server transmission' but URLs and a Google user-ID are in fact sent server-side for every unwhitelisted navigation; and the bundled `web_accessible_resources` grants `[domain withheld] and `[domain withheld] access to `lib/*` and `model/*` in addition to `chrome-extension://*/*` shown in the published manifest, allowing any webpage to probe for extension resources (fingerprinting risk) — neither constitutes malicious intent but the second is a real discrepancy the publisher should correct.