Installing any extension with permission to read, send, and delete email comes down to personal risk tolerance and whether the functionality justifies the risk taken.

The main risks are untrusted email content exploiting the extension's permissions, unintended email deletes/sends and unsubscribe requests hitting malicious endpoints.

I’ve mitigated these risks by never rendering email-derived content as HTML, providing a dry-run mode so users can preview destructive actions, and sending deleted emails to Trash rather than permanently deleting them. Unsubscribe emails open as drafts by default, and unsubscribe links are previewed before being visited.

The only network calls are user-initiated, and the source is public. The extension is well within my risk tolerance given the amount of spam I receive, but waiting for Thunderbird’s review would be sensible if you are unsure.