Is Workstation for Discord safe?

#!/usr/bin/env bash# find_discord_endpoints.sh# Scans an unpacked copy of the extension for references to discord.com /# discordapp.com, and separately lists every https:// URL the extension's# own code actually references.## Usage: ./find_discord_endpoints.sh <path-to-unpacked-extension>set -euo pipefailDIR="${1:?Usage: find_discord_endpoints.sh <path-to-unpacked-extension>}"echo "== References to discord.com / discordapp.com =="grep -rniE "discord\.com|discordapp\.com" "$DIR" --include="*.js" --include="*.html" || echo "(none found)"echoecho "== All https:// URLs referenced in the extension's own code =="grep -rhoE "https://[a-zA-Z0-9._-]+" "$DIR" --include="*.js" --include="*.html" | sort -u

#!/usr/bin/env node// verify_winfy_iframe.js// Reads the popup's CSP meta tag and the iframe target it loads, then makes// a live request to that target so you can see who actually serves it.//// Usage: node verify_winfy_iframe.js <path-to-unpacked-extension>const fs = require('fs');const path = require('path');const extDir = process.argv[2];if (!extDir) {  console.error('Usage: node verify_winfy_iframe.js <path-to-unpacked-extension>');  process.exit(1);}const startHtml = fs.readFileSync(path.join(extDir, 'start.html'), 'utf8');const cspMatch = startHtml.match(/Content-Security-Policy["']?\s*content=["']([^"']+)["']/i);console.log('Popup CSP meta tag:');console.log('  ' + (cspMatch ? cspMatch[1] : '(not found)'));const indexJs = fs.readFileSync(path.join(extDir, 'js', 'index.js'), 'utf8');const srcMatch = indexJs.match(/iframe\.src\s*=\s*['"]([^'"]+)['"]/);if (!srcMatch) {  console.error('No iframe.src assignment found in js/index.js');  process.exit(1);}console.log('\nIframe target found in the extension code:');console.log('  ' + srcMatch[1]);fetch(srcMatch[1]).then(async (res) => {  console.log('\nLive request to that target:');  console.log('  HTTP status: ' + res.status);  for (const [k, v] of res.headers.entries()) {    console.log('  ' + k + ': ' + v);  }}).catch((err) => {  console.error('Request failed: ' + err.message);});