chrome-extension-wxt
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for initializing projects via the npm registry using commands like
npm create wxt@latest, which is the standard scaffolding method for the WXT framework. - [EXTERNAL_DOWNLOADS]: References external GitHub repositories such as
imtiger/wxt-react-shadcn-tailwindcss-chrome-extensionas recommended templates for React and shadcn/ui integration. - [COMMAND_EXECUTION]: Provides standard developer workflows for building and testing extensions, including
npm run devandnpm run buildcommands. - [PROMPT_INJECTION]: Evaluated for indirect prompt injection surfaces typical of browser extensions.
- Ingestion points: Content scripts in
entrypoints/content.tsare designed to process data from third-party websites. - Boundary markers: Documentation explicitly suggests using Shadow DOM via
createShadowRootUito isolate extension UI from host page content. - Capability inventory: Demonstrates use of
chrome.storage,chrome.tabs, andchrome.scriptingfor extension functionality. - Sanitization: The
best-practices.mdfile provides extensive guidance on security, including the use ofDOMPurifyfor input sanitization and strict Content Security Policy (CSP) configurations.
Audit Metadata