Content Security Policy directive: "script-src" issues

The cotnetn rules and thus JS unsafe-inline is mentioned as not allowed here

as unsafe-inline is not in the default CSP for Script-src

And noted in the Google Analytics docs

Since Twitch extensions do not allow inline Javascript

it’s also inferred via 2.8

2.8 All front-end HTML, CSS, and Javascript files used by your Extension must be included in the zip file for your assets. You should not include extraneous files or code not used by your extension.

The restrictions on content, probably, could be more explicit however.