All network activity goes exclusively to `[domain withheld] (:138,,:135,,:135,) — a subdomain of the publisher's own domain ([domain withheld]), making it a first-party data flow. The extension is narrowly scoped to `[domain withheld] (the publisher's own Zendesk tenant) and performs exactly what a Mongolian spell checker should: POSTing typed words to a spell-check API and rendering highlighted suggestions in a custom DOM overlay. The ML model's elevated score is explained by: 30 `appendChild` calls (building the inline spell-checker suggestion UI), 6 POST requests (repeated spell-check API calls on keyup and button click), and large JS size (complex inline UI logic across three development-iteration files). The third-party risk score's low impact and the chrome-stats likelihood signals (low user count, old update) are consistent with an internal corporate tool — not with malware. The one corroborating concern is the publisher's malicious rate on other extensions, which prevents a full `false_positive` verdict, but this extension's code is clean, transparent, and tightly scoped.