ClawHub
Back to skill

Security audit

chrome-extension-wxt

Security checks across malware telemetry and agentic risk

Overview

This is a coherent WXT Chrome-extension development guide, but it includes under-scoped security-sensitive examples that users should review before relying on it.

Review and adjust the generated extension code before use: avoid shipping unsafe-eval CSP, prefer content scripts or narrowly scoped trusted injection, keep host permissions minimal, and do not store API keys or other secrets in browser.storage.sync.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The documentation explicitly recommends adding 'unsafe-eval' to the extension_pages CSP to make React DevTools work. In a browser extension, weakening CSP this way increases the attack surface for script-injection-style abuse and normalizes an unsafe production configuration for a non-essential debugging convenience.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes a script-injection example (`injectScript('/injected.js')`) without any warning about the security boundary between extension and page contexts, trusted script sources, or the risks of injecting logic into arbitrary pages. In a browser-extension skill, this is materially risky because users may copy the pattern into sensitive extensions and use it with untrusted content or broader host permissions, increasing the chance of privilege misuse or page-context abuse.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The guide demonstrates storing an API key in browser.storage.sync without any warning about sensitivity, sync propagation, or exposure risks. This can lead developers to persist credentials across devices and browser profiles in a storage mechanism not intended for secret management, increasing the chance of accidental disclosure or misuse.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.