Extension Permissions & Security Audit

extension-permissions-security · v1.1.0 · paid

Evaluates manifest permissions scope, content security policy, content script isolation, message passing security, and host permission minimization to ensure the principle of least privilege.

Permission Scope & Validation

permission-scope-validation · weight 0.3

Permissions are minimal and justified
ab-001319
critical
No global host permissions (all_urls)
ab-001320
high
activeTab is prioritized over static permissions
ab-001321
high
Heavy permissions are optional
ab-001322
low
Message sender is validated
ab-001323
high

Content Security Policy

content-security-policy · weight 0.3

Script sources are safe (no wildcards)
ab-001324
critical
No unsafe-eval
ab-001325
critical
Object sources are restricted
ab-001326
high
Base URI is restricted
ab-001327
medium
Style sources are safe
ab-001328
medium
Violation reporting is configured
ab-001329
info

Content Script Isolation

content-script-isolation · weight 0.25

Content scripts run in isolated worlds
ab-001330
high
Matches are specific
ab-001331
medium
Page data is sanitized
ab-001332
high
Shadow DOM is used for UI
ab-001333
low
DOM changes are cleaned up
ab-001334
low

Host Permissions Minimization

host-permissions-minimization · weight 0.15

Unused host permissions removed
ab-001335
medium
externally_connectable is restricted
ab-001336
high
Connect-src is limited
ab-001337
low
Web accessible resources are scoped
ab-001338
low
Non-persistent background scripts used where possible
ab-001339
info
Permissions are justified
ab-001340
info