The Mixed Content:... messages are just warnings that the extension icons are stored on a non-https server. You can ignore them.
Starting from pngs should not be a problem at all. Then the script should be usable as is. Use the latest Slicer Stable Release and if you encounter any issues then let me know. Provide enough details that allows me to reproduce what you do.