Is TaskPulse Task Verifier safe?

// Fetches the current target list from taskpul.se and stores it locally
async function syncSettings() {
  const userUuid = (await chrome.cookies.get({
    url: "https://taskpul.se/",
    name: "user_uuid"
  }))?.value ?? null;
  if (!userUuid) return;

  const settings = await fetch("https://taskpul.se/client-api/v1/getSettings", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ userUuid, extVersion: chrome.runtime.getManifest().version })
  }).then(r => r.json());

  // settings.platforms[] names the sites to inject into. None of these
  // domains appear in the extension's manifest.json.
  const platforms = settings.platforms.map(p => ({
    platformId: String(p.platformId ?? ""),
    hostPatterns: p.hostPatterns ?? [],          // e.g. {type:"brand", brand:"linkedin"}
    accountNameParsers: p.accountNameParsers ?? [],
    accountUidParsers: p.accountUidParsers ?? []
  }));

  await chrome.storage.local.set({ platforms, lastSyncAt: Date.now() });
  registerInjectionTargets(platforms);
}

// Turns the server's host patterns into match globs and registers a content
// script for them via chrome.scripting.registerContentScripts()
async function registerInjectionTargets(platforms) {
  const matches = [];
  for (const platform of platforms) {
    for (const pattern of platform.hostPatterns) {
      if (pattern.type === "subdomain_of") {
        matches.push(`https://${pattern.base}/*`, `https://*.${pattern.base}/*`);
      } else if (pattern.type === "brand") {
        matches.push(`https://${pattern.brand}.com/*`, `https://*.${pattern.brand}.com/*`);
      }
    }
  }
  await chrome.scripting.unregisterContentScripts({ ids: ["tp-social-bridge"] }).catch(() => {});
  if (matches.length === 0) return;
  await chrome.scripting.registerContentScripts([{
    id: "tp-social-bridge",
    matches: [...new Set(matches)],              // only possible because the manifest
    js: ["assets/bridge.js", "assets/injector.js"], // already holds host_permissions <all_urls>
    runAt: "document_start",
    persistAcrossSessions: true
  }]);
}

// Requested by injector.js via chrome.runtime.sendMessage({type: "tpInjectMainWorld"});
// runs with world: "MAIN", i.e. inside the page's own JavaScript context,
// not the isolated content-script world.
chrome.scripting.executeScript({
  target: { tabId },
  world: "MAIN",
  func: (captureLimit) => {
    // Waits for your first click on the page, then patches the page's own
    // XMLHttpRequest and fetch so every request/response passes through here.
    window.addEventListener("click", function onFirstClick() {
      window.removeEventListener("click", onFirstClick, true);
      installHooks();
    }, true);

    function installHooks() {
      const originalOpen = XMLHttpRequest.prototype.open;
      const originalSend = XMLHttpRequest.prototype.send;
      XMLHttpRequest.prototype.open = function (method, url, ...rest) {
        this.__tp = { method, url, startedAt: Date.now() };
        this.addEventListener("loadend", function () {
          window.postMessage({
            __tp: "injected",
            type: "capturedXMLHttpRequest",
            url: this.__tp.url,
            method: this.__tp.method,
            status: this.status,
            requestPreview: this.__tp.requestPreview,
            responsePreview: truncate(this.responseText, captureLimit)
          }, "*");
        });
        return originalOpen.apply(this, [method, url, ...rest]);
      };
      XMLHttpRequest.prototype.send = function (body) {
        if (typeof body === "string") this.__tp.requestPreview = truncate(body, captureLimit);
        return originalSend.apply(this, [body]);
      };

      const originalFetch = window.fetch;
      window.fetch = function (input, init) {
        const url = typeof input === "string" ? input : input.url;
        return originalFetch(input, init).then(async (response) => {
          const clone = response.clone();
          const contentType = clone.headers.get("content-type") || "";
          const body = /text|json|javascript|xml/.test(contentType) ? await clone.text() : null;
          window.postMessage({
            __tp: "injected",
            type: "capturedFetch",
            url,
            method: init?.method ?? "GET",
            status: response.status,
            requestPreview: typeof init?.body === "string" ? truncate(init.body, captureLimit) : null,
            responsePreview: body ? truncate(body, captureLimit) : null
          }, "*");
          return response;
        });
      };
    }
  },
  args: [captureLimit]   // 16384 characters by default
});