Is DAMI - Công cụ kết nối & quản lý KOL TikTok toàn diện safe?

else if (r.type === "bg-execute-script") {
  const { tab: w } = l;
  et.tabs.sendMessage(s.id, { type: "tabs-get-common-info", timestamp: Date.now() }).then(v => {
    let x = { ...v, ...r.data };
    x.envMode = "production";
    const V = "https://cos-res.tikclubs.com/dami/scripts/v2-2.0.0/prod";
    x.scriptUrls = [
      `${V}/CSharpCode.js`, `${V}/GlobalData.js`, `${V}/Rpa.js`, `${V}/RpaChat.js`,
      `${V}/damiAdminApi.js`, `${V}/damiTikTokApi.js`, `${V}/content.js`,
      `${V}/protobuf.js`, `${V}/dami_lang_en.js`
    ];
    // ... j0(x, l.tab) is called a few lines below

async function j0(r, l) {
  if (!r.scriptUrls) return;
  r.envMode = "production";
  // Append a cache-busting query to each of the 9 hardcoded CDN URLs
  const o = r.scriptUrls.map(s => s + `?timest=${Date.now()}`);
  // Fetch all 9 files with plain fetch() -- no hash / signature check
  Promise.all(o.map(s => fetch(s).then(f => {
    if (!f.ok) throw new Error(`Failed to load script: ${s} (Status: ${f.status})`);
    return f.text();
  }).catch(f => (console.error(f), "")))).then(async s => {
    const f = s.join("\n");           // join all 9 fetched scripts into one string
    let g = await U0(...);             // resolve the active TikTok Shop / Affiliate tab
    if (g) {
      await tg(g);                     // focus that tab
      // Run the joined, freshly-fetched code in the PAGE'S own MAIN world
      const [{ result: m }] = await et.scripting.executeScript({
        args: [f, r],
        target: { tabId: g.id },
        world: "MAIN",
        func: Yx
      });
    }
  });
}

// Yx runs INSIDE the page (chrome.scripting world:'MAIN'), so `document`
// here is the TikTok Shop tab's own document, not an extension page.
function Yx(r, l, o = []) {
  l = JSON.stringify(l);
  return new Promise((y, w) => {
    const x = document.createElement("script");
    x.classList.add("dm-custom-js");
    // r is the joined text of all 9 files just fetched from the CDN --
    // it is interpolated verbatim into the injected <script>'s source.
    x.textContent = `(() => {
        window.automaFetch = automaFetch
        window.automaUpload = automaUpload
        let scriptParams = ${l}
        ${r}   // <-- the fetched CDN code, executed as page script
    })()`;
    document.head.appendChild(x);   // runs with the page's own privileges
  });
}