drop extension manifest + crx unpack · parse permissions + host access + update url · runs locally
drop extension manifest + crx unpack · local only
heuristic screener · vendor schema varies · not definitive proof