# Extension Manifest

> Generate and validate manifest.json with optimal permissions for Chrome MV3 extensions. Analyzes code to determine minimum permissions. Use when: manifest, permissions, manifest.json.

- **Type:** Skill
- **Install:** `agentstack add skill-quangpl-browser-extension-skills-extension-manifest`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [quangpl](https://agentstack.voostack.com/s/quangpl)
- **Installs:** 0
- **Category:** [Web & Browser](https://agentstack.voostack.com/c/web-and-browser)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [quangpl](https://github.com/quangpl)
- **Source:** https://github.com/quangpl/browser-extension-skills/tree/main/skills/extension-manifest

## Install

```sh
agentstack add skill-quangpl-browser-extension-skills-extension-manifest
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Extension Manifest & Permissions Generator

Generate the best `manifest.json` based on current extension implementation. Analyze code to determine minimum permissions following Chrome docs and best practices.

## Workflow

1. **Detect** framework: check for `wxt.config.ts`, `plasmo.config.ts`, or raw `manifest.json`
2. **Scan** the extension codebase for Chrome API usage
3. **Map** each API call to its required permission (see `references/api-permission-map.md`)
4. **Generate** manifest.json with minimum required permissions
5. **Validate** against Chrome docs and CWS policies
6. **Report** permission warnings users will see

> **Plasmo projects**: Manifest is auto-generated from code and `package.json`. Override via `plasmo.config.ts`. See https://docs.plasmo.com/

## Docs References

- Manifest reference: https://developer.chrome.com/docs/extensions/reference/manifest
- Permissions list: https://developer.chrome.com/docs/extensions/reference/permissions-list

## Quick Manifest Template

```json
{
  "manifest_version": 3,
  "name": "Extension Name",
  "version": "1.0.0",
  "description": "Brief description. Max 132 chars for CWS.",
  "icons": { "16": "icons/icon16.png", "48": "icons/icon48.png", "128": "icons/icon128.png" },
  "action": { "default_popup": "popup.html", "default_icon": { "16": "icons/icon16.png" } },
  "permissions": [],
  "host_permissions": [],
  "background": { "service_worker": "background.js", "type": "module" }
}
```

## Permission Analysis Steps

1. **Grep codebase** for `chrome.` API calls
2. **Map** each to permission using `references/api-permission-map.md`
3. **Prefer** `activeTab` over `tabs` + host_permissions when possible
4. **Use** optional permissions for non-essential features
5. **Check** warning text in `references/permission-warnings.md`

## Common Mistakes

| Error | Fix |
|-------|-----|
| `host_permissions` inside `permissions` | Move URLs to separate `host_permissions` array |
| Using `` | Narrow to specific domain patterns |
| Missing `activeTab` | Add when only needing current tab on user click |
| `tabs` permission overuse | Only needed for tab URL/title; use `activeTab` instead |
| `content_security_policy` as string | Must be object: `{ "extension_pages": "..." }` |
| `web_accessible_resources` as string[] | Use object with `resources` + `matches` |

## Key MV3 Rules

1. `host_permissions` is separate from `permissions`
2. Service workers replace background pages (no DOM, no `window`)
3. `content_security_policy` is an object, not string
4. Remote code execution banned (no eval, no CDN scripts)
5. `web_accessible_resources` requires `matches` array
6. Use `chrome.scripting.executeScript()` not `tabs.executeScript()`

## References

- `references/manifest-fields-reference.md` - All manifest fields with types and examples
- `references/manifest-templates.md` - Ready-to-use templates (popup, content script, sidepanel, devtools)
- `references/manifest-validation-checklist.md` - Pre-submission validation
- `references/api-permission-map.md` - Chrome API → permission mapping
- `references/permission-warnings.md` - User-facing warning text per permission
- `references/permission-strategies.md` - Optional permissions, activeTab, escalation patterns

## Related Skills

- `extension-create` - Full project scaffolding
- `extension-analyze` - Security audit and best practices

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [quangpl](https://github.com/quangpl)
- **Source:** [quangpl/browser-extension-skills](https://github.com/quangpl/browser-extension-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-quangpl-browser-extension-skills-extension-manifest
- Seller: https://agentstack.voostack.com/s/quangpl
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.