i'd say that nos2x, nostr connect, and alby are pretty safe. they don't send your extensions anywhere. it's just stored in local browser data. you could always nuke the extension afterwards.