extension-analyzelisted
Install: claude install-skill andrewr303/claude-codex-plugin-lab
# Extension Analyze (Security & Compliance Auditor)
Audit an existing Chrome extension. Do NOT just explain — execute the workflow.
## Workflow (Execute This)
### Step 1: Locate extension root and detect framework
Ask user for path if not provided. Detect framework:
```bash
ls wxt.config.ts plasmo.config.ts vite.config.ts manifest.json 2>/dev/null
```
- **Plasmo**: manifest auto-generated; check `package.json` and `plasmo.config.ts` instead
- **WXT**: check `wxt.config.ts` manifest section
- **Vanilla/CRXJS**: check `manifest.json` directly
### Step 2: Scan manifest.json (or equivalent config)
```bash
# Check MV version, permissions, host_permissions, CSP, web_accessible_resources
cat <ext>/manifest.json | jq '{manifest_version, permissions, host_permissions, content_security_policy, web_accessible_resources}'
```
### Step 3: Quick grep scans
```bash
# XSS vectors
grep -rn "innerHTML\|outerHTML\|document\.write\|insertAdjacentHTML" <ext>/src --include="*.ts" --include="*.js"
# Unsafe patterns
grep -rn "eval(\|new Function(\|setTimeout.*string\|setInterval.*string" <ext>/src
# Hardcoded secrets
grep -rn "api_key\|apiKey\|secret\|password\|token" <ext>/src --include="*.ts" --include="*.js" | grep -v "\.test\." | grep -v "node_modules"
# HTTP (non-HTTPS) calls
grep -rn "http://" <ext>/src --include="*.ts" --include="*.js"
# Message handler sender validation
grep -rn "onMessage\|addListener" <ext>/src | grep -v "node_modules"
# Remote code loading
grep -rn "importScr