Usually the activation criteria will be "Contact this server and see what it tells me to do".

An extension developer ought to know the exact purpose of every network request their extension makes, so inspecting network logs is indeed a good plan.

Just remember there are ways to detect if the developer tools panel is open...

> Usually the activation criteria will be "Contact this server and see what it tells me to do".

Right, but it could be set up to only do that starting six months after installation or something.

Yep, but it's a good start. Why I called it a "basic audit".