plasmo
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive guide for the Plasmo framework, covering project setup, content scripts, messaging, and storage.
- [SAFE]: Includes explicit security guidance for developers, specifically advising that extension storage is locally readable and that secrets should never be hardcoded in the bundle.
- [EXTERNAL_DOWNLOADS]: Instructions reference the official
pnpm create plasmocommand and dependencies from the@plasmohqscope (e.g.,@plasmohq/storage,@plasmohq/messaging), which are the standard and expected packages for this framework. - [SAFE]: Recommends security best practices for extension development, such as using the principle of least privilege for manifest permissions and host patterns to speed up store review and reduce attack surface.
- [SAFE]: Correctly identifies and explains the use of Shadow DOM for content script UI to provide style isolation from the host page.
Audit Metadata