Since you already came to the conclusion that it would be possible, it is safe to assume, other people might have had the same thought. It's also safe to assume, people might have had those thoughts with a different intention than you had.
You can (if it is implemented purely in JS) read though the code and decide if it is "clean" or not. However this could change with every call you make to the site so I suggest not using them. By the way: at least http://www.passwordmeter.com/ does give you all the calculations in plain text. You can simply do it by hand or write a short script, that tests everything for you.
BTW: I just realized, that very site does not even use transport layer encryption. That's my facepalm of the day.