Why it asks for so little.
The manifest requests activeTab and scripting, and nothing else. There is no host permission for all sites, no background service worker, no network access and no storage.
activeTab grants access to one tab, only when you click the toolbar icon, and only until you navigate away. The extension cannot read any page you have not explicitly pointed it at — which is the whole reason it is built this way rather than with a content script that runs everywhere.
scripting is what lets it inject the collector into that one tab on that one click.
Nothing is transmitted anywhere. The extraction happens in the page, the Design.md is assembled in the popup, and the only outbound action is one you take: clicking Forge opens a new tab pointed at this app with a color in the URL fragment.