skills.rest
FluxonLab
FluxonLabCOMMUNITY
Explore all skills by this author →
Website𝕏@fluxonlabGitHub

chrome-extension-review

Review Chrome extensions for MV3 compliance, security, permissions, and store readiness.

2|Updated Jun 1, 2026
Search Tags:#security review#service worker#chrome extension#manifest v3#web store#content scripts#permissions audit
One-click install
npx skills add https://github.com/FluxonLab/Skillry --skill chrome-extension-review-fluxonlab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: chrome-extension-review
Source: https://github.com/FluxonLab/Skillry/tree/main/plugins/optional-specialist/skills/81-chrome-extension-review
Command: npx skills add https://github.com/FluxonLab/Skillry --skill chrome-extension-review-fluxonlab

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Chrome extensions often fail store review or ship with security flaws due to Manifest V3 migration issues, overly broad permissions, unsafe message passing, and CSP violations. This Skill provides a structured audit procedure that catches these problems before submission. ## Core Features & Use Cases - Manifest V3 Compliance Audit: Verifies service worker background, declarativeNetRequest usage, and the absence of eval or remote code execution. - Security Review: Checks CSP strictness, message sender validation, content script XSS vectors, and web_accessible_resources scoping. - Permission Minimization: Audits every declared permission against actual code usage and flags overly broad host permissions. - Use Case: Before submitting an updated extension to the Chrome Web Store, run this review to produce a findings table with severity ratings, a permission audit, and a store-readiness checklist. ## Quick Start Review the manifest.json, service worker, and content scripts in this extension project for MV3 compliance and Chrome Web Store readiness.

Frequently Asked Questions about chrome-extension-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a Chrome extension for Manifest V3 compliance?▼

Check that manifest_version is 3, background uses service_worker instead of background.page, declarativeNetRequest replaces blocking webRequest, and no eval, new Function, or remote script injection exists. The review also confirms action replaces browser_action.

How to audit Chrome extension permissions for least privilege?▼

List every permission in permissions, optional_permissions, and host_permissions, then verify each is actually used in code. Prefer activeTab over broad host permissions like <all_urls>, and require justification for sensitive permissions such as tabs, history, and cookies.

What CSP is required for Chrome extension pages in MV3?▼

Extension pages must declare a strict content_security_policy in manifest.json, at minimum "script-src 'self'; object-src 'none';". MV3 prohibits unsafe-inline, unsafe-eval, and external script sources for extension pages.

Why is chrome.storage.local unsafe for OAuth tokens?▼

chrome.storage.local is not encrypted and is readable by any code with access to the extension context. Prefer chrome.storage.session, which clears on browser restart, or the OS credential store via native messaging.

When should I not use this Chrome extension review process?▼

It does not fit Firefox or Safari WebExtension reviews where browser-specific APIs differ, pure web apps with no chrome.* API usage, or native messaging host code running as a separate OS-level process.

Related Skills

Explore More Software Engineering Skills→
delorenjdelorenj
14

Chrome Extension Developer

Develop Chrome extensions from ideation to Chrome Web Store deployment.

Community
Advanced
GoogleChromeGoogleChrome
926

chrome-extensions

Generate Manifest V3 Chrome extensions with compliant APIs and store metadata.

Official
Advanced
cwinvestmentscwinvestments
412

memstack-security-dependency-audit

Scan project dependencies for vulnerabilities, outdated packages, and supply chain risks.

Community
Intermediate
FirzusFirzus
1

web-extension

Design, build, and debug browser extensions for Chromium, Firefox, and Safari.

Community
Advanced