ParrotTalks抄筆記 is exactly what it advertises: a Chinese-language click-to-lookup tool with a bundled viewer. Every network destination in the bundle is first-party ([domain withheld] —,,,, /) or a lookup service the product's purpose justifies ([domain withheld] dictionary, [domain withheld], nlp.stanford.edu CoreNLP POS tagger, [domain withheld] for the optional FB); there is no third-party analytics or unknown host anywhere, and the ACTION_SEGMENT_RPC analytics wrapper (:459-480) has no handler in the message switch and no endpoint, i.e. it is dead code. The bundled manifest matches the published CWS manifest field-for-field. The heavy surface that drove the ML score is verbatim Mozilla extension plumbing (:11600-11760: getFrameId GIF trick, PDF main_frame redirects to the local viewer) plus the Google Translate `tk` signing routine (:470-507) — and the extension_pages CSP contains no 'unsafe-eval', so the MV2-leftover `eval(data)` at: throws inside its own and `window.eval` at 10784 references a `window` that does not exist in a service worker. Contradicting signals I weighed: the internal IoC notes attribute this to a [domain withheld] WhatsApp-spamware cluster and a Pulsedive compromised-extension feed, but `grep -rni whatsapp` over the whole bundle returns zero hits and nothing resembles spam automation; the permhash cluster is 'malicious' but both members are this same extension's own versions carrying that same feed label, so it is circular rather than independent. chrome-stats (impact, likelihood, trusted publisher) and the Google trusted-publisher badge corroborate benign. Two genuine weaknesses that do not change intent and so are not logged as findings: (1) injects HTML fetched from [domain withheld] into the page via jQuery `$(...)` on action click — first-party, HTTPS, user-triggered, but a supply-chain single point of failure; (2) accepts window.postMessage with no origin check and proxies it to ACTION_BG_XHR (arbitrary) then posts the reply back with targetOrigin "*" — a confused-deputy hole, though it is limited to [domain withheld] frames and MV3 gives the service worker no host_permissions, so no credentialed cross-origin read is possible. Also worth noting for the listing record: the CWS data-collection disclosure is 'none declared' while the extension clearly transmits user-selected text and account identity to its own API — a disclosure gap, not covert exfiltration. I chose likely_benign over false_positive only because the bundle is partial (28 files vs. the model's counts; the viewer, Angular libs and are absent) and because of the remote-HTML channel, not because anything in the code reads as hostile.