The source code matches the CWS listing exactly: the extension intercepts visits to ~150 enumerated domains, shows a confirmation overlay, and redirects through bypass.tools (the publisher's own domain) to perform server-side bypassing. All outbound network requests go exclusively to bypass.tools; no credentials, page content beyond the shortlink URL, or personal data are transmitted. The ML score of 0.00 already flags this as low-risk, the third-party risk score's 'likelihood' flags are all recency-based rather than behavioral, and the publisher holds a Google trusted-publisher badge — these signals collectively corroborate a benign verdict. The permhash cluster's 11% malware rate is a weak signal here because the extension's code patterns are entirely explained by its stated bypass-helper purpose and share no structural similarity with the malware patterns typically found in that cluster.