Hack-Tools (cmbndhnoonmghfofefkcccljbkdpamhi) is the well-known open-source penetration testing reference extension by LasCC ([domain withheld]), featured on the Chrome Web Store and Google-trusted. The bundled manifest declares zero permissions—no host_permissions, no cookies, no tabs, no webRequest—making any data exfiltration or network interception structurally impossible; the extension is a self-contained local cheat-sheet UI rendered inside the browser's own devtools panel. The ML signal (innerHTML:11, appendchild:35, fromcharcode:14, eval:9) maps directly to React DOM rendering and static pentest payload strings (XSS templates, reverse shell generators) that are the extension's stated, benign purpose—the same patterns that cause AV false-positives noted in user reviews. The third-party chrome-stats score (Impact:1, Likelihood:0) corroborates the ML verdict being a false positive; the publisher's ' malicious' leave-one-out is the only counter-signal, but given zero permissions and a Google-featured, open-source-verifiable codebase it does not override the direct code evidence.