The extension is a straightforward malware-protection tool that does exactly what it advertises: it fetches each page's hostname against Norton to check if it's flagged as 'risky', then blocks the page with a warning overlay if so. All network calls go to public safety-check APIs ([domain withheld], [domain withheld]) — no user data, browsing history, or page content is sent anywhere. The ML score of 0.20 was driven by benign signals: counts from the blocking overlay UI code, and the broad content-script match pattern which is necessary for a page-blocking security extension. Third-party risk score (Impact, Likelihood) and the featured-extension badge corroborate the benign verdict.