菜单
Scan extension source code for Chrome Web Store rejection risks. Generates report with issues, root causes, and fixes. Use when: review, pre-submit, rejection, CWS compliance, store review.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | extension-review |
| description | Scan extension source code for Chrome Web Store rejection risks. Generates report with issues, root causes, and fixes. Use when: review, pre-submit, rejection, CWS compliance, store review. |
Scan extension source code and predict Chrome Web Store rejection risks. Generate a clear report.
Reference: https://developer.chrome.com/docs/webstore/troubleshooting
Ask user: Markdown or HTML report? (default: Markdown)
# Find extension root
ls manifest.json wxt.config.ts plasmo.config.ts package.json 2>/dev/null
Execute these scans in order (see references/scan-checklist.md for grep patterns):
| # | Check | Violation Code | Severity |
|---|---|---|---|
| 1 | Remote code execution (eval, external scripts) | Blue Argon | CRITICAL |
| 2 | Code obfuscation (base64, char encoding) | Red Titanium | CRITICAL |
| 3 | Excessive/unused permissions | Purple Potassium | HIGH |
| 4 | Missing privacy policy | Purple Lithium | HIGH |
| 5 | Missing metadata (icons, description, screenshots) | Yellow Zinc | HIGH |
| 6 | Single purpose violation | Red Magnesium | HIGH |
| 7 | Deceptive behavior (description ≠ functionality) | Red Nickel | HIGH |
| 8 | Insecure data transmission (HTTP) | Purple Copper | HIGH |
| 9 | Keyword stuffing in manifest | Yellow Argon | MEDIUM |
| 10 | Minimum functionality check | Yellow Potassium | MEDIUM |
| 11 | Undisclosed affiliate links | Grey Titanium | MEDIUM |
| 12 | Cryptocurrency mining code | Grey Silicon | CRITICAL |
| 13 | Copyright circumvention (download helpers) | Blue Zinc | CRITICAL |
| 14 | Notification spam patterns | Yellow Nickel | MEDIUM |
| 15 | Data collection without consent | Purple Nickel | HIGH |
Output report using template in references/report-template.md.
Report structure per issue:
## Issue: [Name]
- **Severity**: CRITICAL / HIGH / MEDIUM
- **Violation Code**: [Chrome code, e.g. Blue Argon]
- **Root Cause**: [What in your code triggers this]
- **File(s)**: [Exact file paths and line numbers]
- **Solution**: [Step-by-step fix]
Report summary:
| Severity | Count |
|----------|-------|
| CRITICAL | X |
| HIGH | X |
| MEDIUM | X |
| PASS | X |
Verdict: LIKELY APPROVED / NEEDS FIXES / WILL BE REJECTED
extension-review-report.md in project rootextension-review-report.html with simple, readable stylingreferences/scan-checklist.md — Grep patterns and detection logic for all 15 checksreferences/violation-codes.md — All Chrome Web Store violation codes with descriptionsreferences/report-template.md — Markdown and HTML report templatesextension-analyze — Deeper security audit (code quality, XSS, CSP)extension-publish — Full publishing workflow after review passesextension-manifest — Fix manifest issues found in reviewGenerate and manage all Chrome extension assets: icons (16–128px), CWS listing images, promotional tiles, and public/ folder setup. Supports ImageMagick, Gemini API, and manual prompt templates.
Build polished Chrome extension UIs (popup/sidepanel/options). Analyze existing UI, suggest improvements, set up design systems, enforce a11y and UX best practices.
Build backend APIs for Chrome extensions. NestJS + MongoDB (Mongoose) recommended stack. Auth, webhooks, license verification, CORS. Use when: backend, API, server, database, license, webhook.
Integrate payment gateways into Chrome extensions. Stripe, Paddle, Lemon Squeezy, Polar, PayPal, and more. Licensing, subscriptions, freemium. Use when: payment, monetize, subscribe, billing, premium.
Detect Chrome extension framework/stack, find proper docs, implement features, and debug across service worker, content script, and popup contexts.
Auto-scaffold Chrome extensions with WXT or Plasmo. Ask user for name/features, scaffold, configure entrypoints. Use when: create extension, scaffold, new extension.