Reading the only code the manifest actually runs ( + on [domain withheld], plus and the two services), this is a straightforward Perplexity chat exporter: it scrapes the visible thread DOM via CSS selectors (:7-33), renders, downloads via chrome.downloads, and optionally syncs to Google Drive / Dropbox / Yandex / Notion using each provider's own OAuth endpoints — all of which the listing advertises. No chrome.cookies / history / webRequest / scripting use, no eval or Function constructor, no obfuscated string tables, and the running content scripts never touch document.cookie, localStorage or Authorization headers. Contradicting the ML score: the counters are inflated by dead weight the manifest never loads ( is 312K of localized store-listing copy for a DevTools paste script; 7 of 9 content/*.js are sibling-product clones; is inert because the manifest declares no declarativeNetRequest permission). The one real concern, kept as a medium finding, is that the default PDF path uploads the full conversation HTML to the publisher's own Cloud Run backend (:956 tries the server first, client rendering is only a fallback) and every export POSTs to keyed to a persistent UUID, while the CWS disclosure is 'none declared' and the listing copy states 'No uploads to external servers' / 'everything processed locally'. Manifest cross-check: bundled and published host_permissions and web_accessible_resources match exactly; the bundle additionally declares activeTab, which the published summary omits — a superset by the lowest-risk permission, most likely version skew, and not the delayed-malicious direction. Hygiene, not findings::18 and ship hardcoded Notion and Yandex OAuth client secrets (the publisher's own credentials, exposed to anyone who unpacks the CRX), and 's 'fetch_json' handler proxies an arbitrary URL without validating the sender, which is only reachable from extension pages and the [domain withheld] content script. Confidence is medium, not high, because and are referenced by the manifest but absent from this bundle, so one injected bundle went unread — that gap is also the most likely source of the single html_base64_obfuscation hit, since none of the bundled HTML files contain a data: URI or a long base64 run. The 59%-malicious permhash cluster is weak corroboration here: the CROSS_PROMOTIONS list and the build_clone.py branding note in show ~30 sibling exporters sharing one manifest template, so the cluster is plausibly this publisher's own family labelled en masse, and our own internal note says the malware classification came from a bulk feed import and is 'not an independent code review'. Publisher reputation ( siblings malicious, trusted badge, featured) and the chrome-stats score are consistent with benign but are inputs I treat as context only.