Open source + p2p. Why wouldn't you trust it?

Automatic updates?

So turn them off. You can do that in Firefox, I don't know about Chrome, but if you're using that then you already are trusting Google just as much as if you use this extension.

It's not open source until we can have the source.

The old repo (https://github.com/UWNetworksLab/uproxy-common) mentions the new repo, which is hidden / not available.

So, not yet open source. So, still closed source, for now.