chrome-extension-wxt

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for initializing projects via the npm registry using commands like npm create wxt@latest, which is the standard scaffolding method for the WXT framework.
  • [EXTERNAL_DOWNLOADS]: References external GitHub repositories such as imtiger/wxt-react-shadcn-tailwindcss-chrome-extension as recommended templates for React and shadcn/ui integration.
  • [COMMAND_EXECUTION]: Provides standard developer workflows for building and testing extensions, including npm run dev and npm run build commands.
  • [PROMPT_INJECTION]: Evaluated for indirect prompt injection surfaces typical of browser extensions.
  • Ingestion points: Content scripts in entrypoints/content.ts are designed to process data from third-party websites.
  • Boundary markers: Documentation explicitly suggests using Shadow DOM via createShadowRootUi to isolate extension UI from host page content.
  • Capability inventory: Demonstrates use of chrome.storage, chrome.tabs, and chrome.scripting for extension functionality.
  • Sanitization: The best-practices.md file provides extensive guidance on security, including the use of DOMPurify for input sanitization and strict Content Security Policy (CSP) configurations.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 08:18 AM