itsdivyanshjain/Bystander ? reverse-engineered prompt

Build me a Chrome extension that passively watches network requests while I browse and flags possible security issues in the browser itself.

I want it to notice things like CSRF, clickjacking, possible injection points, API token leaks, PII leaks, and useful clues like staging domains or admin pages showing up in frontend code or traffic. It should show the findings in a simple popup list with a severity style label, and it should be possible to turn on a testing mode so it reduces noisy alerts during penetration testing.

Please make it easy to add new detection rules later by editing a single rules file, and keep the app light enough to run in the browser without needing a server. If you need to look up current Chrome extension docs online, feel free to do that. Also include a clear way to load it unpacked and make sure it works across normal browsing without getting in the way.