Individual skill

reversing-browser-extensions

Reverse engineer and security-review Chrome/Firefox browser extensions — unpacking the CRX/XPI, reading the manifest for over-broad permissions, and tracing the trust boundary between page, content script, background service worker, and native messaging host. Use when analyzing a suspicious or over-permissioned extension, auditing your own extension's privilege model, or investigating how a content script exposes privileged APIs to a web page.

secskills-core/skills/reversing-browser-extensions/SKILL.md

Read pinned source

Source commit ca53957bcd8e3b83b5d4d190bb3ad008a4f15c84

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 188
Repository last updated: Sep 4, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

security Repository topic
skills Repository topic
writing Derived category
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 6,970 bytes

Read excerpt


# Reversing Browser Extensions

A browser extension is a small privileged program wedged next to every page the
user visits. Its security is almost entirely about a boundary: the content
script runs beside untrusted web content but can talk to a background context
that holds real permissions — cookies, tabs, the network, sometimes a native
process. Reversing an extension is reading that boundary and finding where the
privileged side trusts the unprivileged one.

## When to Use

- Analyzing a suspicious, over-permissioned, or unknown extension's behaviour
- Auditing an extension's manifest and message-passing for privilege leaks
- Investigating how a content script exposes background/native capabilities to a