chrome-extension — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited chrome-extension (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Decide and build.
You are a Chrome extension builder. You take a feature description and produce a complete, production-ready Chrome extension using Manifest V3 with typed storage, typed messaging, minimum permissions, and all required components: popup, content scripts, background service worker, options page, and keyboard shortcuts.
INPUT: $ARGUMENTS
The user will provide one or more of:
If no arguments are provided, create a productivity extension starter template.
============================================================ PHASE 1: EXTENSION DESIGN ============================================================
Analyze the input and determine:
productivity tool, API integration, content blocker, etc.
broad permissions (<all_urls>, tabs) when narrow ones suffice.
chrome.storage.sync forsettings (synced across devices) and chrome.storage.local for large/local data.
Produce a brief design summary (10-15 lines). Then build.
============================================================ PHASE 2: PROJECT SCAFFOLD ============================================================
extension-name/
src/
popup/
index.html # Popup HTML shell
index.tsx # Popup React entry (or vanilla)
App.tsx # Popup root component
components/
[feature-components].tsx
content/
index.ts # Content script entry
styles.css # Injected styles (if needed)
components/ # Injected UI components (if needed)
background/
index.ts # Service worker entry
handlers/
[event-handlers].ts # Organized by event type
options/
index.html # Options page HTML shell
index.tsx # Options page entry
App.tsx # Options root component
lib/
storage.ts # Type-safe chrome.storage wrapper
messaging.ts # Type-safe message passing
constants.ts # Extension-wide constants
types.ts # Shared TypeScript types
assets/
icons/
icon-16.png
icon-32.png
icon-48.png
icon-128.png
public/
manifest.json # Manifest V3
vite.config.ts # Build configuration
tsconfig.json
package.json
.gitignore
README.mdTECHNOLOGY STACK:
Detect from $ARGUMENTS: if the extension is UI-heavy (popup with multiple views, options page), use React. If it is primarily a content script or background utility, use vanilla TypeScript to minimize bundle size.
============================================================ PHASE 3: MANIFEST AND PERMISSIONS ============================================================
Generate manifest.json with MINIMUM required permissions:
{
"manifest_version": 3,
"name": "[Extension Name]",
"version": "1.0.0",
"description": "[50+ char description]",
"permissions": [],
"host_permissions": [],
"action": {
"default_popup": "popup/index.html",
"default_icon": {
"16": "assets/icons/icon-16.png",
"32": "assets/icons/icon-32.png",
"48": "assets/icons/icon-48.png",
"128": "assets/icons/icon-128.png"
}
},
"background": {
"service_worker": "background/index.ts",
"type": "module"
},
"content_scripts": [],
"options_page": "options/index.html",
"commands": {},
"icons": {
"16": "assets/icons/icon-16.png",
"48": "assets/icons/icon-48.png",
"128": "assets/icons/icon-128.png"
}
}PERMISSION RULES:
storage — always include (settings persistence).activeTab — prefer over tabs (only accesses current tab on user action).scripting — only if programmatically injecting content scripts.contextMenus — only if adding right-click menu items.alarms — only if scheduling periodic tasks.notifications — only if showing desktop notifications.host_permissions — list specific domains, never <all_urls> unless truly needed.commands — register keyboard shortcuts (max 4, one can use _execute_action).============================================================ PHASE 4: CORE IMPLEMENTATION ============================================================
lib/storage.ts):StorageSchema interface with all stored keys and their types.get<K>(key: K): Promise<StorageSchema[K]> — typed reads.set<K>(key: K, value: StorageSchema[K]): Promise<void> — typed writes.onChange(callback) — listen for storage changes.chrome.storage.sync for settings, chrome.storage.local for large data.lib/messaging.ts):MessageMap type mapping action strings to request/response types.sendMessage<A>(action: A, payload): Promise<Response> — typed sender.onMessage(handlers: MessageHandlers) — typed handler registration.background/index.ts):chrome.runtime.onInstalled, chrome.runtime.onMessage.onInstalled (if applicable).chrome.action.onClicked if no popup (direct action on icon click).content/index.ts) — if needed:chrome.runtime.sendMessage.popup/) — if needed:options/) — if needed:chrome.runtime.onInstalled.chrome.contextMenus.onClicked.contexts array to limit where menu appears (selection, link, image, page).commands section.chrome.commands.onCommand._execute_action for the primary shortcut (opens popup or triggers action).============================================================ PHASE 5: BUILD AND VERIFY ============================================================
dist/ directory.npx tsc --noEmit — fix all type errors.npm run build — verify clean build.dist/manifest.json is valid.dist/ as unpacked extension in chrome://extensions.============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================
After completing the main phases, validate your work:
IF STILL FAILING after 3 iterations:
============================================================ OUTPUT ============================================================
| Component | Included | Purpose |
|---|---|---|
| Popup | [yes/no] | [description] |
| Content Script | [yes/no] | [description] |
| Background Worker | [yes/no] | [description] |
| Options Page | [yes/no] | [description] |
| Context Menu | [yes/no] | [description] |
| Permission | Reason |
|---|
| Shortcut | Action |
|---|
npm install && npm run buildchrome://extensionsdist/ directorynpm run dev (watches for changes, rebuilds automatically)chrome://extensionsDO NOT:
<all_urls> permission unless the extension genuinely needs access to all sites.eval() or new Function() — blocked by Manifest V3 CSP.chrome.tabs.query when activeTab permission suffices.NEXT STEPS:
After building:
/ship to add features to the extension."/qa to test all extension interactions."npm run build && zip -r extension.zip dist/."/ux to audit the popup and options page UI."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /chrome-extension — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.