browser-extension-reverse

What problem does it solve? Security analysts and reverse engineers often receive a browser extension (crx, xpi, or an unpacked directory) and need a repeatable way to audit its permissions, background workers, and hidden credential or traffic logic instead of guessing where to start. ## Core Features & Use Cases - Manifest and Permission Audit: Unpacks crx/xpi packages and evaluates manifest.json permissions, host_permissions, and content_scripts for over-privileged access such as <all_urls> or webRequest. - Background Logic Recovery: Traces MV2/MV3 service workers, content script injection points, chrome.storage/IndexedDB secrets, and runtime.sendMessage data flows. - Dynamic Debugging Workflow: Guides loading unpacked extensions in developer mode and attaching DevTools or CDP/Frida hooks to service workers. - Use Case: During a supply-chain investigation of a suspicious Chrome extension, use this Skill to enumerate its permission surface, locate the keylogging logic in the background worker, and extract IOCs for a YARA rule. ## Quick Start Analyze this unpacked Chrome extension directory and list its permission risks, background entry points, and any credential or network exfiltration logic.