build-chrome-extension
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides local utility scripts (
check-mv3-manifest.shandpreflight-extension.sh) that utilize Node.js to validate the structure and security of a built Chrome extension. These scripts perform deterministic checks on the local manifest and filesystem without performing network operations or executing untrusted code. - [EXTERNAL_DOWNLOADS]: Installation instructions refer to the author's official repository on GitHub for fetching the skill and its components. These resources are consistent with the skill's origin and intended functionality.
- [INDIRECT_PROMPT_INJECTION]: While the skill analyzes user-provided extension files, it mitigates injection risks by enforcing strict validation of manifest fields, Content Security Policy (CSP) configurations, and permission justifications. It proactively warns against broad host permissions like
<all_urls>.
Audit Metadata