chrome-ext-storage — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited chrome-ext-storage (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Chrome extensions have four storage areas plus IndexedDB. Each serves a different purpose with different lifecycles, quotas, and trade-offs. Choose based on data size, persistence needs, and cross-device requirements.
| Mechanism | Best For | Capacity | Lifecycle |
|---|---|---|---|
storage.session | Hot state, temporary variables | 10 MB (in-memory) | Clears on browser close |
storage.local | Device settings, cached data | 10 MB (expandable) | Persists until extension removed |
storage.sync | User preferences across devices | 100 KB total | Syncs across Chrome instances |
storage.managed | Enterprise-pushed config | Read-only | Set by IT admin policy |
| IndexedDB | Large datasets, binary data | ~80% disk | Persists until extension removed |
`storage.session` — In-memory state that must be fast but doesn't need to survive browser restart. Service worker volatile cache. Authentication tokens for the current session.
`storage.local` — Default choice for most extension data. Settings, cached API responses, user data that stays on one device. Use unlimitedStorage permission to remove the 10 MB cap.
`storage.sync` — Small user preferences that should follow the user across devices. Subject to strict quotas: 8 KB per item, 512 items max, 1,800 writes/hour.
IndexedDB — Large datasets, binary data (images, model weights, video metadata), or data requiring structured queries. No JSON serialization overhead (uses structured cloning). Can use ~80% of available disk.
storage.local or storage.sync — these are NOT encrypted. Use storage.session for temporary auth tokens (clears on browser close).chrome.storage only accepts JSON-serializable types. No Date, Set, Map, RegExp, or class instances.For high-performance state management across service worker restarts:
// Service worker — write-through cache
let cache: AppState | null = null;
async function getState(): Promise<AppState> {
if (!cache) {
const result = await chrome.storage.local.get('appState');
cache = result.appState ?? DEFAULT_STATE;
}
return cache;
}
async function setState(update: Partial<AppState>) {
cache = { ...(await getState()), ...update };
await chrome.storage.local.set({ appState: cache });
// onChanged listeners in popups/side panels auto-update
}WXT provides a reactive storage API with automatic change notifications:
import { storage } from 'wxt/storage';
const userSettings = storage.defineItem<Settings>('local:settings', {
defaultValue: { theme: 'light' },
});
// Read
const settings = await userSettings.getValue();
// Write
await userSettings.setValue({ theme: 'dark' });
// Watch for changes (works across all contexts)
userSettings.watch((newValue) => {
updateUI(newValue);
});chrome.storage are slow. Use IndexedDB for large data.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.