Are my API keys at risk?

No more than your computer itself.

Chrome extensions run solely within your browser on your computer. Any and all third-party communication or access requires explicit permissions from the user prior to any information being sent. This data consists mainly of server-side commands to place trades on your behalf using TradingView alert messages.

Chrome extensions are securely stored and verified prior to upload to Google's Chrome Web Store.

Additional security: When an exchange has optional permissions on their API credentials, it is always in your best interest to enable permissions you understand and expect to be used. Autoview does not currently have any withdrawal ability implemented nor will withdrawal permission ever be required.