re-browser-ext
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard system utilities such as
unzip,jq, andgrepto perform static analysis on browser extension files. These commands are used for their intended purpose in a security context. - [EXTERNAL_DOWNLOADS]: Recommends the installation of
js-beautifyfrom the npm registry andjqfrom official system package managers (APT, Homebrew). These are established, legitimate tools for code formatting and data processing. - [INDIRECT_PROMPT_INJECTION]: The skill outlines procedures for ingesting and processing data from untrusted browser extension packages.
- Ingestion points: Extension manifest files (
manifest.json) and JavaScript source code. - Boundary markers: The skill does not define specific delimiters for parsed output, but focuses on manual/structured analysis.
- Capability inventory: File system access for unpacking and analysis, shell execution for tool usage.
- Sanitization: Relies on the security properties of standard parsing tools like
jqto handle metadata extraction.
Audit Metadata