Extension Store Readiness Auditor
Audit browser-extension packages with versioned policy snapshots and baseline comparisons.
The problem it solves
Extension Store Readiness Auditor [](https://github.com/loganpendragonmultiverse/extension-store-readiness-auditor/actions/workflows/ci.yml)
Who Extension Store Readiness Auditor is for
- Developers and maintainers who need reviewable evidence before changing or releasing software.
- Users working with browser extensions, store readiness, security audit who want the documented v1.1.0 behavior.
- People who prefer an open-source release with visible limitations, source, and license terms.
Intended result
Audit browser-extension packages with versioned policy snapshots and baseline comparisons.
This summary is reconciled from the current catalog and repository documentation.
Features in v1.1.0
Capabilities below come from the current project README and release documentation.
[](https://github.com/loganpendragonmultiverse/extension-store-readiness-auditor/actions/workflows/ci.yml)
Audit an unpacked browser extension or ZIP/XPI/CRX package for review risks shared by the Chrome Web Store, Firefox Add-ons, and Microsoft Edge Add-ons. The local CLI validates the package boundary, Manifest V3 metadata, declared icons, sensitive permissions, broad host access, executable remote-code patterns, unsafe content-security-policy values, custom update URLs, and development debris. Versioned local policy profiles make additional store requirements and their provenance explicit without silently changing the built-in checks.
Verified examples
Screenshots are shown only when the current README references a local source image. Otherwise, repository example files are linked directly.
Platforms and implementation
The public release claims only the cataloged platforms and technologies.
Supported platforms
- Windows
- macOS
- Linux
Built with
- Python
Quick start
The shortest documented path into the current release.
python -m pip install .
extension-store-audit path/to/extension.zip
extension-store-audit path/to/unpacked --target chrome --target edge --format json --output audit.json
extension-store-audit path/to/extension.zip --policy examples/policy-profile.json --format json --output current.json
extension-store-audit path/to/extension.zip --policy examples/policy-profile.json --baseline previous.jsonExit code 0 means no static errors, 1 means the report contains errors requiring correction, and 2 means the package or command could not be analyzed. Existing reports are never overwritten.
Current limitations
These boundaries are part of the product and prevent the page from implying unverified capability.
The checks are conservative static heuristics, not legal advice or a guarantee of marketplace acceptance. Store policies and reviewer practices change. A policy profile is only as accurate as its sources, review date, and operator-authored requirements. Permission usage cannot always be proven from bundled code, minified code can reduce evidence quality, and a clean report does not replace current policy review, functional testing, privacy disclosures, screenshots, reviewer credentials, or human inspection.
Privacy and licensing
Review the actual data boundary before using a tool with sensitive inputs.
Privacy and safety
Everything runs locally. The auditor does not upload packages, execute extension code, contact URLs found in the package or policy profile, use telemetry, or require an account. ZIP paths, duplicate names, file counts, and uncompressed sizes are checked before analysis.
License and release
Extension Store Readiness Auditor is published under MIT. The current cataloged release is v1.1.0, published 2026-08-07.
Related projects
Related projects are selected deterministically from shared catalog tags, category, and implementation technologies—not popularity or paid placement.
Extension Store Readiness Auditor v1.1.0
Use the tagged release for downloads and release notes. Use the repository for source, issues, contribution guidance, security reporting, and complete documentation.
Page source: current Forge catalog plus README and CHANGELOG from the canonical local repository. Fingerprint: 013c20ca7c4edaaf.