The lack of a network call doesn't prove the extension is safe. It might cache some data you want to keep private, and send it periodically.