Store reviewers reject extensions that load remote code or ask for access to every site, and a secret key in extension code is public the moment anyone unzips your package. This skill finds those and eight other extension mistakes before you submit, and tells you how to fix each one.

Your agent runs a scanner on your extension: every manifest.json with a manifest_version and the JavaScript, TypeScript and HTML that belong to it (also Vite and webpack layouts with the manifest in public/ and code in src/). It reads the manifest as JSON (comments and trailing commas allowed) and the code with comments skipped, and knows which keys are meant to be public in a browser (Firebase web keys, Stripe publishable keys, anon JWTs). Test files are skipped. It never loads or runs the extension. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• B01: unsafe-eval, http(s) sources or * in the extension pages' script-src

• B02: externally_connectable open to every site or every extension

• B03: eval() or new Function() on values, or tabs.executeScript with code

• B04: <script src> pointing to another server in an extension page

• B05: a secret API key, token or password written in extension code

REVIEW (check before release)

• B11: <all_urls> or :///* host access

• B12: manifest_version 2

• B13: risky permissions (cookies, debugger, history, proxy, nativeMessaging and others)

• B14: web_accessible_resources that expose every file to every site

• B15: innerHTML, outerHTML, insertAdjacentHTML or document.write with values

• B16: message listeners that do not check the sender or origin

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example extension, and the real report the scanner produces on the risky one

Limits

It reads files as written: bundled or minified output, third-party libraries and the store listing are not checked, and values are followed within one file. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 14 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.