If you are worried if the installed-through-the-store version is the same so you could just unpack it and compare with the code release. Or pack that yourself and install it, but updates through the store should at least prompt you when the extension asks for more permissions than it currently has.
The extension can store data (synced if you are logged in to chrome), get metadata about and manipulate your tabs (including the URL, which might be security-relevant), and can call Google Analytics.
actually, you can still inspect the code for the "compiled product" you download from the store- your chrome path contains a directory containing all extensions, finding them is a little bit hard, because they use their keys as foldernames but you can actually still inspect the source