The whole bundle is a coherent, heavily commented WordPress tech-stack detector: is read-only signature matching (it never creates elements, rewrites hrefs or injects frames), probes only the scanned site's own /, /?feed=rss2 and /<slug> plus [domain withheld], and only caches scans in chrome.storage and flips the toolbar icon. The only outbound third-party call is a credential-less no-cors GET to [domain withheld]> (:191) whose labels are static slugs built at: ('plugin:elementor', 'host:Kinsta', 'scan:wordpress'), carrying no URL, hostname or page content, so no browsing data leaves the browser. Contradicting signals: the permhash cluster is 8% malicious and chrome-stats reports a policy_violation removal, which is inconsistent with the live listing being active and updated two days ago; corroborating benign: the bundled MV3 manifest is strictly narrower than the published MV2 one (it drops 'tabs' in favour of, which 's own header comment explains), the reverse of a delayed-malicious update, and publisher reputation is clean. Residual, non-finding concerns: [domain withheld] ownership cannot be verified from the bundle, the 'scan:wordpress' beacon fires automatically rather than on a click, and the popup composes result markup with innerHTML, so page-derived names should be escape-checked as hygiene.