So, given that all these hackers want to know whether they can trust this, I downloaded the pkg and had a look at the source code. The main file seems legit. I don't understand the popup.html file and the call to flickr though. (also, the packaging is a bit sloppy with two copies of the same file).