All three scripts are short, unminified and do exactly what the Privacy & Security listing describes::24-49 sets a hardcoded chrome.proxy fixed_servers HTTPS proxy to [domain withheld] (same operator as PREMIUM_LINK at:10-11),:51-63 clears it, and storage holds one boolean (vpnEnabled). There is no fetch, XHR, WebSocket, PAC script, remote config, onAuthRequired hook, eval or Function constructor anywhere, so no code path collects or transmits anything. The contradicting signals are not independent of each other: the internal note is a malext-feed import that states it is 'not an independent code review', the publisher's malicious siblings and the 38% permhash-cluster share plausibly trace to that same feed, and the chrome-stats impact reason cites permission-clipboard, a permission present in neither the bundled nor the published manifest. The bundled manifest matches the published summary exactly (MV3, proxy + storage), so there is no mismatch. Hygiene concerns that are not code findings: the operator is unattributable (gmail author, [domain withheld] privacy policy), the proxy is unauthenticated, the extension opens a [domain withheld] tab on install (:121-123), the THEME string 'batch-08-v-c-shield' suggests a mass-produced template, and traffic is routed with 'none declared' data collection. Server-side logging by that operator cannot be ruled out from the client code, which is why this is likely_benign rather than false_positive.