← LeaderboardThe Skill Leaderboard

browser-extension-reverse

Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research.

Published by sickn33 ↗sickn33/agentic-awesome-skills

Try your first task

Start a fresh conversation. Replace the highlighted placeholders.

Use browser-extension-reverse to statically analyze [authorized extension package or extracted directory] identified by [version and hash], within [written authorized scope]; enumerate manifest permissions and entry scripts, trace background/content-script/storage/message data flows, and report evidence-backed overpermission or data-exposure concerns. Do not perform dynamic analysis.

Required inputs

[authorized extension package or extracted directory]
[version and hash]
[written authorized scope]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: browser-extension-reversedescription: "Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research."risk: offensivesource: "https://github.com/zhaoxuya520/reverse-skill"source_repo: "zhaoxuya520/reverse-skill"source_type: communitydate_added: "2026-08-25"license: "MIT"license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

Ask the user to state the exact target URL, IP, account, or resource.

Ask the user to confirm written authorization and the permitted scope.

Show the exact command(s) and explain their expected effect.

Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Browser Extension Reverse Engineering

When to Use

Auditing a browser extension's behavior and permissions in an authorized review.
Investigating how an extension handles credentials or sensitive page data.

适用场景

Chrome/Edge MV2/MV3 扩展分析
Firefox 扩展
恶意扩展 IOC、供应链扩展投毒调查
扩展实现的签名/加密/代理逻辑还原

工作流

1. 包体

□ crx 解压 / 从 profile 取扩展目录
□ manifest.json：permissions、host_permissions、background、content_scripts
□ 评估过度权限（<all_urls>、webRequest、debugger）

2. 逻辑

□ service_worker / background 入口
□ content_script 注入点与世界（isolated）
□ chrome.storage / IndexedDB 密钥
□ 与 `js-reverse` 相同：Observe 网络与消息传递（runtime.sendMessage）

3. 动态

□ 开发者模式加载解压目录
□ chrome://extensions 检查错误
□ DevTools 附加 service worker
□ 必要时 Frida/浏览器 CDP（jshookmcp）

工具链

工具	用途
解压/jq	manifest
Chrome DevTools	worker 调试
js-reverse 工具链	深度 JS
YARA	恶意扩展规则

参考

references/extension-analysis.md
field-journal 扩展恢复相关条目
../js-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R30
下游: 复杂混淆 JS → js-reverse；投毒调查 → supply-chain / malware

任务完成自检

是否列出权限面与入口脚本？
是否还原关键数据流？
Checklist？

Limitations

Extension stores update frequently; findings can go stale.
Dynamic analysis requires a profile isolated from personal accounts.

Adapted from zhaoxuya520/reverse-skill (MIT).