Is 图片批量下载助手 safe?

var baseUrl = 'https://chrome.tool56.com';// Dev fallback: switch to HTTP on .t TLDif (window.location.protocol === 'http:' && window.location.href.includes('.t/'))  baseUrl = 'http://chrome.tool56.t';baseUrl += '/image-downloader/2.0/2.1.html';baseUrl += '?v=' + Math.floor(Date.now() / 60000);  // cache-bust per minuteconst host = document.createElement('chrome-ext');host.id = 'chromeExt';document.body.parentNode.insertBefore(host, document.body.nextSibling);shadowRoot = host.attachShadow({ mode: 'open' });// Inject the remote iframe — no integrity attributeshadowRoot.innerHTML = `  ...  <iframe id="imageDownloader" src="${baseUrl}" class="ext-frame"></iframe>  ...`;

case 'fetchUrlData':  var url = e.url || '';  var headers = e.header || {};  // caller-supplied, no validation  var readType = e.readType || 'readAsText';  var result = { url: url, status: 0 };  fetch(url, headers)  // any URL, any headers    .then(function(response) {      response.blob().then(function(blob) {        var reader = new FileReader();        reader.onloadend = function() {          result.data = this.result;        // full response body          result.status = 1;          result.type = response.type;          result.contentType = response.headers.get('Content-Type');          result.contentSize = response.headers.get('Content-Length');          result.statusCode = response.status;          result.statusText = response.statusText;          const allHeaders = {};          response.headers.forEach((v, k) => { allHeaders[k] = v; });          result.header = allHeaders;       // all response headers          sendResponse(result);             // returned to remote iframe        };        if (typeof reader[readType] !== 'function') readType = 'readAsText';        reader[readType](blob);      });    })    .catch(function(err) {      console.error('request error', err);      result.status = 0;      sendResponse(result);    });  return true;  // keep message channel open for async response

case 'requestFetchUrlData':  var msg = n;          // n.url, n.header from the remote iframe  msg.type = 'fetchUrlData';  // Forward to background service worker  chrome.runtime.sendMessage(msg, function(bgResponse) {    // Return full response (body + headers) to the remote iframe    postMessage(bgResponse, callbackId);  });  break;