Extension Scanner
Live permission + manifest analysis for Chrome extensions.
The problem
Extensions get install access in seconds. They can read every page, exfiltrate data, hijack sessions — and most orgs have zero visibility into what they can actually do.
What it does
Submit an extension ID and we pull its live manifest straight from the Chrome Web Store, score every permission by risk, flag dangerous combinations (all-sites + code injection, all-sites + traffic interception), and summarize host reach. Or paste a manifest.json to score it offline.
Capabilities
- Live manifest pull from the Chrome Web Store by ID
- Permission risk scoring (0-100) with per-permission rationale
- Dangerous-combination detection (inject-everywhere, traffic capture)
- Manifest V2/V3 aware; flags off-store update URLs + remote CSP
- Runs in the browser or as an npm package / CI gate
How you run it
Paste an extension ID (or a manifest) in the browser for an instant score. Subscribers can install @playciso/extscan and fail CI on any critical/high permission risk.
Roadmap
- Live Web Store manifest fetch + CRX parse
- Permission scoring + dangerous combos
- In-browser ID / manifest lookup
- npm package + CI gate
- Publisher history + Firefox/Edge support
Extension Scanner runs inside PlayCISO for subscribers. The source stays private — no public repos, nothing to fork, nothing for attackers to study. Weekly, monthly, and yearly plans all include every tool.