browser-extension-builder
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard boilerplate code and architectural patterns for browser extension development using Manifest V3, focusing on educational templates.
- [PROMPT_INJECTION]: No evidence of prompt injection, jailbreak attempts, or instructions to bypass safety guidelines was found in the instructions or metadata.
- [DATA_EXFILTRATION]: The skill demonstrates the use of standard
chrome.storageAPIs for local data persistence and does not contain any patterns for network exfiltration or sensitive data harvesting. - [COMMAND_EXECUTION]: No shell commands, subprocess calls, or system-level execution patterns were identified in the provided templates.
- [EXTERNAL_DOWNLOADS]: The skill does not reference or download any external scripts, binaries, or unverifiable dependencies from remote sources.
- [OBFUSCATION]: All content is provided in clear text with no evidence of Base64 encoding, zero-width characters, homoglyphs, or other obfuscation techniques.
- [PRIVILEGE_ESCALATION]: The skill explicitly promotes security best practices by including an anti-pattern warning against requesting excessive permissions, advocating for the principle of least privilege.
- [INDIRECT_PROMPT_INJECTION]: While the skill provides templates for content scripts that ingest data from web pages (
document.querySelector), it does not pair this with dangerous capabilities like network exfiltration or dynamic execution, presenting no significant risk.
Audit Metadata