The extension is a straightforward Salesforce developer tool that injects a UI into the Apex Code Coverage table at specific *.[domain withheld] URLs. All JavaScript is readable source (no minification or obfuscation), makes zero network requests, reads no sensitive data, and only manipulates DOM elements within the Salesforce page it was granted access to via content_scripts. The ML score of 0.64 was almost certainly driven by low-signal feature counts (2x innerHTML, 2x appendChild, small file size) that are trivially explained by the extension's legitimate DOM manipulation. The bundled manifest matches the published manifest summary exactly — no permission discrepancies. Our own risk engine returned 0.00 risk with zero findings, directly contradicting the ML score.