extension-js
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and commands for the 'extension' npm package (authored by wottpal), which is a legitimate and well-known developer tool for building browser extensions.
- [SAFE]: All external references point to official documentation sites, including developer.chrome.com, developer.mozilla.org, playwright.dev, and the tool's official domain extension.js.org.
- [SAFE]: The skill explicitly instructs users on security best practices, such as protecting credentials (avoiding EXTENSION_PUBLIC_* for secrets) and adhering to Manifest V3 security requirements (local bundling, CSP compliance).
- [SAFE]: Instructions regarding the use of 'npm exec' and 'npx' are standard for Node.js development workflows and do not involve unauthorized or hidden execution of remote scripts.
- [INDIRECT_PROMPT_INJECTION]: While the skill involves reading untrusted project files (manifests, scripts) as part of a development workflow, it provides clear guidance on boundaries and validation (e.g., 'Messages are an input boundary', 'Keep page-derived text out of unsafe HTML insertion'), mitigating typical injection risks associated with processing external data.
Audit Metadata