The extension code is a straightforward SOCKS5 proxy client: calls chrome.proxy.settings.set() with hardcoded server IPs and [domain withheld] subdomains, render a server list and relay messages to the worker. There is no data exfiltration, no obfuscation, no remote code loading, no tracking, and no credential theft. The only permissions declared in the bundled manifest are ['proxy'], which exactly matches the published manifest summary — no mismatch. The ML score of 0.21 and our risk engine's Critical finding are driven entirely by the proxy permission itself, which is the expected and necessary permission for any extension; this is not a false positive in the security sense but a category-appropriate permission use. One minor concern is brand inconsistency: the extension is 'Happ Proxy' on CWS, coded as 'Амнезия VPN' (Amnesia Team), hosted at [domain withheld], and the premium upsell links to [domain withheld] with a referral code — suggesting an affiliate relationship with a third-party VPN provider rather than a unified operator, which is common in this category but slightly opaque. The third-party chrome-stats score citing clipboard access does not appear in the manifest or any code; it is a false signal.