Hi aus9. Just two more thoughts for completeness's sake:
1. Inspecting extensions
To inspect ownerships and permissions inside an extension, don't extract it. When contents are extracted and written to your drive (or to your RAM), ownerships and permissions can change. To inspect an extension, look inside it without extracting it, like this:
unsquashfs -lls foo.tcz
To see ownership and permissions of root directory of all your loaded extensions, do:
ls -l /tmp/tcloop
2. Flexibility of the extension system
TCL is very flexible and forgiving when it comes to ownerships and permissions in extensions. For example, wiki recommends root:staff 775 for startup scripts, but submitqc was forcing tc:staff 755 for a long time without any problems. Also, wiki recommends root:root for most directories and files, but I've seen extensions where everything is owned by tc:staff (or 1000:staff in the case of some of my old extensions) and they work just fine. Furthermore, most extensions have tc:staff ownership of squashfs-root directory, but you'll also see root:root (or 1000:staff in the case of some of my old extensions) and it makes little difference.
IMHO the job of submitqc should be twofold: 1. correct obvious errors (most important) and 2. ensure conventions and wiki recommendations are followed (less important, but still a nice service and cosmetically desirable).
[Edit]: Fixed typo, changed 1001:staff to 1000:staff. Rich