Extension Review (Pre-Submission Scanner)
Scan extension source code and predict Chrome Web Store rejection risks. Generate a clear report.
Reference: https://developer.chrome.com/docs/webstore/troubleshooting
Workflow (Execute This)
Step 1: Ask report format
Ask user: Markdown or HTML report? (default: Markdown)
Step 2: Locate and scan extension
# Find extension root
ls manifest.json wxt.config.ts plasmo.config.ts package.json 2>/dev/nullStep 3: Run all checks
Execute these scans in order (see references/scan-checklist.md for grep patterns):
| # | Check | Violation Code | Severity |
|---|---|---|---|
| 1 | Remote code execution (eval, external scripts) | Blue Argon | CRITICAL |
| 2 | Code obfuscation (base64, char encoding) | Red Titanium | CRITICAL |
| 3 | Excessive/unused permissions | Purple Potassium | HIGH |
| 4 | Missing privacy policy | Purple Lithium | HIGH |
| 5 | Missing metadata (icons, description, screenshots) | Yellow Zinc | HIGH |
| 6 | Single purpose violation | Red Magnesium | HIGH |
| 7 | Deceptive behavior (description ≠ functionality) | Red Nickel | HIGH |
| 8 | Insecure data transmission (HTTP) | Purple Copper | HIGH |
| 9 | Keyword stuffing in manifest | Yellow Argon | MEDIUM |
| 10 | Minimum functionality check | Yellow Potassium | MEDIUM |
| 11 | Undisclosed affiliate links | Grey Titanium | MEDIUM |
| 12 | Cryptocurrency mining code | Grey Silicon | CRITICAL |
| 13 | Copyright circumvention (download helpers) | Blue Zinc | CRITICAL |
| 14 | Notification spam patterns | Yellow Nickel | MEDIUM |
| 15 | Data collection without consent | Purple Nickel | HIGH |
Step 4: Generate report
Output report using template in references/report-template.md.
Report structure per issue:
## Issue: [Name]
- **Severity**: CRITICAL / HIGH / MEDIUM
- **Violation Code**: [Chrome code, e.g. Blue Argon]
- **Root Cause**: [What in your code triggers this]
- **File(s)**: [Exact file paths and line numbers]
- **Solution**: [Step-by-step fix]Report summary:
| Severity | Count |
|----------|-------|
| CRITICAL | X |
| HIGH | X |
| MEDIUM | X |
| PASS | X |
Verdict: LIKELY APPROVED / NEEDS FIXES / WILL BE REJECTEDStep 5: Save report
- Markdown: save as
extension-review-report.mdin project root - HTML: save as
extension-review-report.htmlwith simple, readable styling
References
references/scan-checklist.md— Grep patterns and detection logic for all 15 checksreferences/violation-codes.md— All Chrome Web Store violation codes with descriptionsreferences/report-template.md— Markdown and HTML report templates
Related Skills
extension-analyze— Deeper security audit (code quality, XSS, CSP)extension-publish— Full publishing workflow after review passesextension-manifest— Fix manifest issues found in review