Is Adblock for Youtube™ safe?

// Fetches rules from the remote server on every service worker start
async function fetchServerData() {
    try {
        const response = await fetch(
            `https://api.adblock-for-youtube.com/api/v2/rules?version=${EXTENSION_VERSION}`
        );
        return await response.json();
        // Returns: { networkRules, cssRules, popupConfig, scripletsRules, updatePageConfig }
    } catch (e) {
        console.log(e);
        return null;
    }
}

// Injects server-controlled scriptlets into a YouTube tab
async function executeScriptOnPage(tabId, script) {
    // Wraps the server-supplied code in an IIFE with error suppression
    const injectionString = `(()=>{ try { ${script}; } catch(e) { console.log(e) } })();`;
    await chrome.scripting.executeScript({
        target: { tabId },
        func: injectedFunction,
        injectImmediately: true,
        world: 'MAIN',       // runs with same privileges as the page itself
        args: [injectionString, 'aby-38oj8EJVO3Uu7t4G9PdfI'],
    });
}

// Called on every tab load — combines server scriptlets with hardcoded inline scripts
async function getScriptsAndInject(tabId) {
    const scriptlets = getScriptletString(Settings[SettingsKeys.ScripletsRules]); // from remote fetch
    const inlineScripts = inlineScriptsArray.join(';');
    await executeScriptOnPage(tabId, scriptlets + inlineScripts);
}

// Values read at extension load time — before any user interaction.
const EXTENSION_VERSION = chrome.runtime.getManifest().version;  // e.g. "7.0.8"
const EXTENSION_ID      = chrome.runtime.id;                      // e.g. "cmedhionkhpnakcndndgjdbohmhepckk"

const INSTALL_URL   = `https://get.adblock-for-youtube.com/install?v=${EXTENSION_VERSION}&xtid=${EXTENSION_ID}`;
const UNINSTALL_URL = `https://get.adblock-for-youtube.com/uninstall?v=${EXTENSION_VERSION}&xtid=${EXTENSION_ID}`;
const UPDATE_URL    = `https://get.adblock-for-youtube.com/update?v=${EXTENSION_VERSION}&xtid=${EXTENSION_ID}`;

// Runs once when the extension is first installed.
chrome.runtime.onInstalled.addListener(({ reason }) => {
  if (reason === chrome.runtime.OnInstalledReason.INSTALL) {
    // Opens a visible tab — the URL contains the extension ID.
    await createTab(INSTALL_URL);
  }
});

// Registers the uninstall URL so the server is notified on removal.
chrome.runtime.setUninstallURL(UNINSTALL_URL);

// On the first startup AFTER an update, opens a tab to the update URL.
chrome.runtime.onStartup.addListener(async () => {
  const showUpdate = await getFromChromeStorage('ShowUpdatePageNextLaunch');
  if (showUpdate) {
    await createTab(UPDATE_URL);  // also contains xtid + new version
  }
});

// On each page navigation:
// 1. Read scripletsRules from chrome.storage (populated from server)
// 2. For each rule {name, args}, look up the scriptlet function body
//    from the embedded scriptletsLib catalogue
// 3. Assemble: `(scriptletFunction)(source, args)` strings, join with ';'
// 4. Wrap in an IIFE and inject via chrome.scripting.executeScript
//    into world:'MAIN' — the page's own JavaScript context
//
// The server controls: which scriptlet names appear, and their args.
// The scriptlet function bodies are bundled in the extension.
// Example observed rule: {name:'set-constant', args:['ytInitialPlayerResponse.adPlacements','undefined']}
// → injects code that overwrites window.ytInitialPlayerResponse.adPlacements = undefined