I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you visit (which is potentially unsafe).

The author responds to this with "Don't be alarmed. Vimium never talks to any servers and does absolutely nothing with your data. Read the open source code if you're paranoid."

I have no reason to be suspicious except the fact that if there is malicious JS code in this extension, it could really do a lot of damage (steal passwords etc).

One way of verifying that this extension is indeed safe is by monitoring Chrome network communication.

Other would be (as author suggested) to inspect the code. Has anybody already did this, and if yes, what are the findings (preferably published on the web)?