Is Gaea Extension safe?

Browser extension that communicates with Gaea service endpoints. The extension includes a postMessage handler without origin validation, but this vulnerability only exists within the extension's popup UI (not in content scripts injected into third-party pages), limiting the attack surface to scenarios where an attacker already controls the popup context.