extension-security-review

Identify install surfaces and attack vectors in extensions, plugins, or repositories.

Updated Apr 14, 2026

Search Tags:#security #plugin #extension #trust #risk-assessment #supply-chain #vetting

Ready to run

npx skills add https://github.com/lhohan/agentfiles --skill extension-security-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: extension-security-review
Source: https://github.com/lhohan/agentfiles/tree/main/.agents/skills/extension-security-review
Command: npx skills add https://github.com/lhohan/agentfiles --skill extension-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Untrusted extensions and plugins pose security and compliance risks; this skill provides a formal review workflow to identify and mitigate those risks before installation.

Core Features & Use Cases

Install-surface identification: determine what an extension will access or execute.
Risk and trust assessment: inspect scripts, dependencies, and maintainer signals to gauge overall risk.
Reproducible review workflow: apply a repeatable process in CI or manual checks before enabling code from external sources.

Quick Start

Run a security review on the target extension path or URL to obtain a risk verdict and recommended mitigations.

Frequently Asked Questions about extension-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security review on a browser extension before installing it?▼

To perform a security review on a browser extension, inspect high-signal files, dependencies, and maintainer signals. Verify lifecycle scripts and execution capabilities against a structured policy to identify potential attack vectors and exfiltration paths.

What attack vectors should I look for when vetting plugin dependencies?▼

When vetting plugin dependencies for attack vectors, assess lifecycle scripts, required permissions, and execution capabilities. This identifies potential exfiltration paths and supply-chain risks presented by the external code in your intended environment.

How can I assess the install surface and risk of an untrusted repository?▼

Assess the install surface of an untrusted repository by identifying what it will access or execute. Inspect maintainer signals, dependency risk, and high-signal files to gauge overall trust and determine required permissions against a structured policy.

Can I use a structured policy to verify lifecycle scripts and dependency risk?▼

Yes, you can verify lifecycle scripts and dependency risk against a structured policy. This reproducible review workflow determines required permissions, identifies exfiltration paths, and produces a risk verdict with mitigation guidance before enabling extensions.

What is the best way to mitigate supply-chain risks from external extensions?▼

The best way to mitigate supply-chain risks from external extensions is applying a reproducible review workflow. Inspect maintainer signals, dependency risk, and execution capabilities to produce a formal risk verdict and recommended mitigations before installation.

When do I need a formal security review workflow for plugins?▼

You need a formal security review workflow for plugins when untrusted external code poses compliance risks. Apply manual checks or CI processes before enabling extensions to identify install surfaces, mitigate attack vectors, and ensure structured policy compliance.