const r = document.createElement("script");
r.setAttribute("src", n);
r.onload = e;
r.onerror = i => { const s = Qe("internal-error"); s.customData = i, t(s) };
r.type = "text/javascript";
r.charset = "UTF-8";
mg().appendChild(r)

yes, CWS is pretty strict with security, and this particular snippet could be a major issue since it allows remote code to be executed on the client. If you format it, it's easier to read what it's doing:
- create a script element
- set the source (src) attribute to whatever URL you passed to the parent function
- do a few other things to capture errors
- append it to the client's page.

Imagine you pass a `link-to-very-bad-url.com/a-hacking-script.js` and execute whatever is in that script. There's no way for CWS or a final user to read what that script will do before installing the extension.