Well, you can inspect the entirety of the plugin code yourself. While they could of course update it with something bad, there is nothing inherently hidden from you that I'm aware of.
Second way, and probably the best, would be to go to its store page, and in the URL will be the extension ID; for Ghostery, it's "mlomiejdfkolichcflejclcbmpeaniij". Now, just find that in your Chrome installation directory, e.g. for Win7 the extension would be located at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\.
The last way would be to intercept or otherwise directly down the .crx file (curl, wget, etc.), which is just a compressed zip archive. You can do the same for FF extensions as well, those .xpi files are just zip files.
They're also an ad (analytics?) company. I just don't trust them.