Skip to content
Get packs

Browser Extension Reverse Engineering

Guides an agent through analyzing Chrome/Firefox extensions: permissions, background scripts, and traffic or credential logic.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

This skill gives an AI agent a step-by-step method for taking apart a browser extension (the add-on files that run inside Chrome, Edge or Firefox). Once installed, the agent unpacks the extension, reads its manifest to list what it is allowed to access, then looks at background scripts, content scripts and network or storage hooks to work out how it handles data, signatures or encryption. It also covers spotting over-broad permissions and investigating malicious or supply-chain-poisoned extensions.

Great for

  • Security researchers auditing suspicious or malicious browser extensions
  • Developers verifying what a third-party extension does with credentials or traffic
  • Students learning how browser extension architecture (MV2/MV3, service workers) works

Skip it if

  • Ordinary web page JavaScript, which the skill itself routes to a different js-reverse skill; the wrong tool for the job
  • Analyzing extensions you have no authorization to inspect, since the skill is framed around authorized testing and recovering credential logic could enable misuse
  • Non-technical users wanting a simple answer about whether an extension is safe; the output is a technical workflow, not a verdict

Try asking

  • “Unpack this Chrome extension folder and list every permission and host permission it requests, flagging anything overly broad.”
  • “Trace how the background service worker in this extension stores and sends session tokens.”
  • “Help me load this unpacked extension in developer mode and check chrome://extensions for errors.”
  • “Write YARA-style indicators to look for in this suspected malicious Firefox add-on.”
Step-by-step guide: how to use Browser Extension Reverse EngineeringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    browser-extension-reverse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip browser-extension-reverse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip browser-extension-reverse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • State clearly that you have authorization to analyze the extension before asking the agent to recover logic.
  • Point the agent at the unpacked extension directory so it can read manifest.json first.
  • Run any dynamic analysis in an isolated browser profile, since loading an unknown extension can expose your own data.

What's inside

  • references/extension-analysis.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.