The bundle contains no weather functionality at all. Its only real behaviour is 's `chrome_settings_overrides.search_provider` with `is_default: true` hijacking default search to `[domain withheld]` with a id (`s=c9pr`), plus `incognito: spanning`, while:31-50 derives every user-facing link (privacy, terms, uninstall, hub) from that same `[domain withheld]` domain rather than the `getweather.today` domain the CWS listing advertises, and the listing claims results are 'powered by Yahoo'. The ML regex hits are all benign on inspection (innerHTML is popup templating at:252, the encoded strings are the `weather_list` cookie, are jQuery internals, the http links are SVG `xmlns` attributes), so the 0.86 score is right for the wrong reasons; chrome-stats independently flags `permission-override-search-provider` and the publisher is feed-flagged, which corroborates search monetisation, while our risk engine's 0.00 and the single `cookies` optional permission contradict any data-theft reading. The published-manifest summary omits `chrome_settings_overrides` and `optional_host_permissions`, but it also omits name, version, background and homepage, so it is a partial projection and not a genuine mismatch; `slick. ` ships in the CRX per but was not extracted into the bundle, which caps confidence at medium. Two hygiene issues (unescaped server-writable cookie data into innerHTML at:252, neutered by the MV3 `script-src 'self'` CSP, and `onMessageExternal` at:17 with no sender check letting any installed extension close popup windows) are noted here rather than logged as findings.