extension-backend

extension-backend is a skill for Claude Code, Codex from quangpl/browser-extension-skills. It costs 49 tokens per session (1,020 once invoked), scanned A, original, MIT.

A skill for building backend services for Chrome extensions with NestJS and MongoDB, including server-side authentication, payments, webhooks, and data storage.

In plain words
What is it for?
Designing extension APIs, authentication, license checks, payment webhooks, data synchronisation, external-service proxies, and rate limiting.
Why use it?
It helps move sensitive work such as API keys, user accounts, licenses, payments, and cross-device data out of the browser extension.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Designing extension APIs, authentication, license checks, payment webhooks, data synchronisation, external-service proxies, and rate limiting.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/quangpl/browser-extension-skills/extension-backend
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add quangpl/browser-extension-skills --skill extension-backend
Clone the repo
git clone --depth 1 https://github.com/quangpl/browser-extension-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for extension-backend

README.md
[![agentmods](https://agentmods.dev/badge/skills/quangpl/browser-extension-skills/extension-backend/github.svg)](https://agentmods.dev/skills/quangpl/browser-extension-skills/extension-backend)
Your own site
<a href="https://agentmods.dev/skills/quangpl/browser-extension-skills/extension-backend"><img src="https://agentmods.dev/badge/skills/quangpl/browser-extension-skills/extension-backend/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for extension-backend

Your own site · 80×15
<a href="https://agentmods.dev/skills/quangpl/browser-extension-skills/extension-backend"><img src="https://agentmods.dev/badge/skills/quangpl/browser-extension-skills/extension-backend.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 49 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,020 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00049 $0.01020
Opus 5 $0.00024 $0.00510
Sonnet 5 $0.00010 $0.00204
Haiku 4.5 $0.00005 $0.00102

Measured 10d ago against content hash fdbd556179ef, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

extension-backend scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/extension-backend/SKILL.md · 114 lines

How it starts

The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Extension Backend

Build a secure, maintainable backend API for a Chrome extension. Recommended stack: NestJS + MongoDB (Mongoose).

When to Activate

Activate this skill when extension work requires:

  • License verification / payment webhooks
  • User authentication / account management
  • Data sync across devices
  • External API proxy (hide API keys from extension)
  • Any server-side logic

Workflow (Execute This)

Step 1: Ask user to confirm requirements

  1. Do you need a backend? (explain why: API keys, auth, payments, sync)
  2. Stack preference: NestJS + MongoDB (recommended) or custom?
  3. Hosting target: Vercel / Railway / Fly.io / AWS / self-hosted?
  4. Features needed (pick from):
    • User auth (Google OAuth via chrome.identity)
    • License/subscription verification
    • Payment webhooks (Stripe, Paddle, etc.)
    • Data sync / storage API
    • External API proxy
    • Rate limiting

Step 2: Fetch framework docs

Use docs-seeker skill to fetch latest docs:

Step 3: Scaffold the backend

npx @nestjs/cli new extension-backend --strict --package-manager pnpm
cd extension-backend
pnpm add @nestjs/mongoose mongoose @nestjs/config class-validator class-transformer
pnpm add helmet @nestjs/throttler
pnpm add -D @types/express

Step 4: Project structure

src/
├── main.ts                          # Bootstrap, CORS, helmet, validation
├── app.module.ts                    # Root module
├── config/
│   └── configuration.ts             # Env-based config
├── auth/
│   ├── auth.module.ts               # Auth module
│   ├── auth.controller.ts           # POST /auth/verify-token
│   ├── auth.service.ts              # Token validation logic
│   └── guards/auth.guard.ts         # Global auth guard
├── license/
│   ├── license.module.ts
│   ├── license.controller.ts        # GET /license/verify
│   ├── license.service.ts           # License CRUD
│   └── schemas/license.schema.ts    # Mongoose schema
├── webhook/
│   ├── webhook.module.ts
│   ├── webhook.controller.ts        # POST /webhook/stripe
│   └── webhook.service.ts           # Process payment events
└── common/
    ├── filters/http-exception.filter.ts
    ├── interceptors/logging.interceptor.ts
    └── dto/                          # Shared DTOs

Read the full file on GitHub · 114 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 114 lines · 49 tokens per session scan A fdbd556179ef

Subscribe to this mod's changes

extension-backend is a skill published in the GitHub repository quangpl/browser-extension-skills (49 stars, last pushed 3mo ago), licensed MIT. It adds 49 tokens to every session and 1,020 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

nosqli

NoSQL injection — MongoDB operator injection ($ne, $gt, $where, $regex), CouchDB / Firebase / Redis attack patterns, auth bypass, blind extraction.

PurpleAILAB/Decepticon · 38 tokens

openloomi-api

OpenLoomi ships a local-first HTTP API served from the desktop app (port 3414, fallback 3515). All auth, Memory, AI, RAG, Loop, and Audit data live in a local SQLite database — your data stays on your machine and the OpenLoomi app is the source of truth. The only externally-routed auth path is the Composio OAuth…

melandlabs/openloomi · 106 tokens

byted-supabase

A command-line and chat-based operations guide for Volcengine’s Supabase-compatible backend platform, including databases, authentication, storage, realtime data, server functions, and hosting. It is a Volcengine service, not the official open-source Supabase product.

bytedance/agentkit-samples · 215 tokens

api-reference

Memoria REST API endpoints, request/response formats, auth, rate limits. Use when calling or implementing API endpoints.

matrixorigin/memoria · 27 tokens

byted-volcengine-mongodb

An operations tool for Volcengine MongoDB, a document database that stores data in flexible, JSON-like records. It can query managed MongoDB instances and return details for further explanation or diagnosis.

bytedance/agentkit-samples · 82 tokens

dynamic

Fullstack development with bkend.ai BaaS — authentication, database, API integration. Triggers: fullstack, BaaS, login, signup, database, web app.

ww-w-ai/bkit-claude-code · 38 tokens