Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →bilal140202/chrome-extension-review
Use when you need to review Chrome extension manifests, content scripts, background workers, permissions, and store-readiness.
Passed 17 of 22 test cases with the skill, and 17 of 22 without it.
1 fixed16 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
We are building a C++ desktop host application that receives native messages over stdin and stdout. Can you review this C++ binary source code for buffer overflow vulnerabilities, pointer safety, and OS-level access control?
| Checked | Without skill | With skill |
|---|---|---|
| Decline Chrome extension audit scope for OS-level native messaging binary code | Missed | Passed |
| Provide security advice appropriate for native C++ messaging applications | Passed | Passed |
The instructions your model reads when the skill loads.
Review Chrome extensions for Manifest V3 compliance, security (CSP, XSS, privilege escalation), permission minimization, message-passing correctness, content script isolation, and Chrome Web Store policy readiness.
manifest.json, service worker, content scripts, or popup pages.chrome.* API usage."manifest_version": 3 — MV2 extensions are being phased out and will stop working in Chrome.background.service_worker replaces background.scripts / background.page from MV2.declarativeNetRequest replaces webRequest blocking mode — verify rules are defined in _rules.json or fetched via updateDynamicRules.action replaces browser_action / page_action.eval(), no new Function(string), no chrome.tabs.executeScript with a string body loaded from a remote URL.content_scripts must not use document.write().permissions, optional_permissions, and host_permissions.activeTab over broad host_permissions like <all_urls> or *://*/* when the extension only needs the current tab.tabs, history, bookmarks, cookies, webNavigation, downloads, nativeMessaging) require clear justification in the store listing.scripting permission: verify chrome.scripting.executeScript is not used to inject remotely-fetched code strings.storage vs unlimitedStorage: only request unlimitedStorage if the data volume genuinely requires it.https://api.example.com/* is better than https://*/*.https://*.example.com/*) must be justified — ensure the extension does not accidentally run on all subdomains of a large service.chrome.permissions.request() rather than declared statically for permissions not needed at install time.test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.