Earlier quoted context omitted.
A few things to be wary of: * KeePassHTTP doesn't use authenticated encryption for its protocol and thus is insecure (decrypt password level insecure). Please make sure you don't have this issue. * Browser integration means there is only some JS code between my unlocked password vault and random websites. Please study findings from Tavis Ormandy and others who found such vulnerabilities in LastPass et al
Your second point is a great point, and I believe that there should be a user prompt every time something tries to read from the password database over any API. With that said, what's the threat model for the first point? Is localhost interception a serious risk?
As far as I know, localhost can't be intercepted. Except for unintentional mistakes such as binding to 0.0.0.0 instead of 127.0.0.1.
And inevitably there are going to be some tinkerers who'll run it over the network because it suits them.