extension-analyze

Extension Analyze (Security & Compliance Auditor)

Audit an existing Chrome extension. Do NOT just explain — execute the workflow.

Workflow (Execute This)

Step 1: Locate extension root and detect framework

Ask user for path if not provided. Detect framework:

ls wxt.config.ts plasmo.config.ts vite.config.ts manifest.json 2>/dev/null

• Plasmo: manifest auto-generated; check package.json and plasmo.config.ts instead
• WXT: check wxt.config.ts manifest section
• Vanilla/CRXJS: check manifest.json directly

Step 2: Scan manifest.json (or equivalent config)

# Check MV version, permissions, host_permissions, CSP, web_accessible_resources
cat <ext>/manifest.json | jq '{manifest_version, permissions, host_permissions, content_security_policy, web_accessible_resources}'

Step 3: Quick grep scans

# XSS vectors
grep -rn "innerHTML\|outerHTML\|document\.write\|insertAdjacentHTML" <ext>/src --include="*.ts" --include="*.js"

# Unsafe patterns
grep -rn "eval(\|new Function(\|setTimeout.*string\|setInterval.*string" <ext>/src

# Hardcoded secrets
grep -rn "api_key\|apiKey\|secret\|password\|token" <ext>/src --include="*.ts" --include="*.js" | grep -v "\.test\." | grep -v "node_modules"

# HTTP (non-HTTPS) calls
grep -rn "http://" <ext>/src --include="*.ts" --include="*.js"

# Message handler sender validation
grep -rn "onMessage\|addListener" <ext>/src | grep -v "node_modules"

# Remote code loading
grep -rn "importScripts\|fetch.*\.js\|eval\|chrome\.scripting\.executeScript" <ext>/src

Step 4: Check CSP configuration

• MV3 default CSP: script-src 'self'; object-src 'self'
• Flag any unsafe-inline, unsafe-eval, or http: sources
• Verify no remote script sources

Step 5: Dependency audit

cd <ext> && npm audit --json | jq '.vulnerabilities | to_entries[] | {pkg: .key, severity: .value.severity}'

Step 6: Generate report

Output findings grouped by severity. See Output Format below.