chrome-extension-messaging-tests
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely instructional, providing best practices and code snippets for asserting message passing behavior in Chrome extensions. All referenced domains (e.g., example.com) and documentation links (developer.chrome.com) are well-known and safe sources.
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes handling data from extension messages, which represents a potential untrusted data ingestion surface.
- Ingestion points:
chrome.runtime.onMessageandchrome.runtime.onMessageExternallisteners used to receive payloads from other extension components or web pages. - Boundary markers: The instructions explicitly recommend routing on a message-type field so that exactly one listener owns each type, which serves as a logical boundary.
- Capability inventory: The snippets include standard capabilities such as network requests (
fetch) and native messaging (connectNative). - Sanitization: The skill notes that Chrome enforces JSON serialization on these messages, which prevents the transfer of complex executable objects like functions.
Audit Metadata