One approach would be to intercept your own traffic with Fiddler as a proxy for a few hours after installing and look for any nefarious requests. This is a pretty effective way to run a basic security audit.
Usually the activation criteria will be "Contact this server and see what it tells me to do".
An extension developer ought to know the exact purpose of every network request their extension makes, so inspecting network logs is indeed a good plan.
Just remember there are ways to detect if the developer tools panel is open...
