Full disclosure: I work for SQL Sentry and the entire concept of giving Plan Explorer to the community was one of the motivating factors in my accepting their job offer last year.
Plan Explorer simply presents plan information better than SSMS. Why are you suspicious that it is going to modify data or do anything malicious? What would a reputable company gain from doing anything like that? You can read this blog post from Greg Gonzalez (SQL Sentry's President and CEO) that explains how Plan Explorer came about.
When you're looking at a plan, it does nothing at all to your server or your data. It is just interpreting XML and presenting it a little differently. You can read the product page for some of the features, and the user guide where we describe how we improve on the SSMS functionality.
In fact the only way you can get it to do anything to your server is if you generate an estimated or actual plan. And here is what happens in either of those cases:
If you generate an estimated plan, it does exactly what Management Studio does when you have a query window and click "Show estimated plan." It sends the Command Text input and retrieves the plan XML output from SQL Server. It also prompts you for credentials every time (unless you opened the plan with the new SSMS add-in that I blogged about yesterday).
If you generate an actual plan, the query you specified is sent to the server and executed, and while the plan XML and runtime metrics are retrieved, the query results are simply discarded and not returned to the Plan Explorer UI. You are prompted here as well for credentials, unless you used the add-in, which puts you in the correct connection context.
It's very concerning that you would assume that a free tool must be doing something malicious or would have any reason to modify data. Can you explain your thinking here?