storage
Stores exactly one boolean — whether URL values inside a document are rendered as clickable links — so the choice survives a page reload. No page content, no URLs, and no identifiers are written.
Content script on all URLs
A JSON or YAML document can be served from any origin, so there is no useful subset of hosts to request: an API on one domain and a raw file on another are the same use case. The script therefore runs everywhere, but it is inert on almost every page — it analyses the response and returns immediately unless the result is a supported format. Nothing is read, stored, or sent for any other page.
No remote code
There is no eval and no remotely hosted script. Every dependency is bundled into the extension and reviewed as part of the Chrome Web Store submission.