Thread:Extension talk:GoToShell/XSS

Does it pass user input directly to the browser? I don't see anyplace that it accepts user input at all, which is why I didn't use escapeshellarg or escapeshellcmd.