Extension Store Readiness Auditor
Validates manifest-referenced local service worker, content-script JS/CSS, popup, options and devtools members; empty popups remain valid.
The problem it solves
Extension Store Readiness Auditor Audit an unpacked browser extension or ZIP/XPI/CRX package for review risks shared by the Chrome Web Store, Firefox Add-ons, and Microsoft Edge Add-ons. The local CLI validates the package boundary, Manifest V3 metadata, declared icons, sensitive permissions, broad host access, executable remote-code patterns, unsafe content-security-policy values, custom update URLs, and development debris. Versioned local policy profiles make additional store requirements and their provenance explicit without silently changing the built-in checks.
Who Extension Store Readiness Auditor is for
- Developers and maintainers who need reviewable evidence before changing or releasing software.
- Users working with browser extensions, store readiness, security audit who want the documented v1.3.0 behavior.
- People who prefer an open-source release with visible limitations, source, and license terms.
Intended result
Validates manifest-referenced local service worker, content-script JS/CSS, popup, options and devtools members; empty popups remain valid.
This summary is reconciled from the current catalog and repository documentation.
Features in v1.3.0
Capabilities below come from the current project README and release documentation.
Audit an unpacked browser extension or ZIP/XPI/CRX package for review risks shared by the Chrome Web Store, Firefox Add-ons, and Microsoft Edge Add-ons. The local CLI validates the package boundary, Manifest V3 metadata, declared icons, sensitive permissions, broad host access, executable remote-code patterns, unsafe content-security-policy values, custom update URLs, and development debris. Versioned local policy profiles make additional store requirements and their provenance explicit without silently changing the built-in checks.
Verified examples
Screenshots are shown only when the current README references a local source image. Otherwise, repository example files are linked directly.
Platforms and implementation
The public release claims only the cataloged platforms and technologies.
Supported platforms
- Windows
- macOS
- Linux
Built with
- Python
Changelog
Release notes from the canonical v1.3.0 source tag.
- Preserve omitted or empty action popup declarations as valid no-popup behavior.
- Validate declared local extension entrypoints against the bounded package inventory.
- Add synthetic regression coverage and packaged development/testing documentation.
- Add permission-version diffs, declared-versus-observed namespace evidence, policy-age checklists and CRX/XPI container fixtures.
- Added regression coverage for the audited behavior and invalid inputs.
- Added versioned local policy profiles with review dates, source links, store targets, required
manifest fields and files, severity overrides, and deterministic profile fingerprints.
- Added baseline report comparison for new, resolved, and unchanged findings.
- Embedded policy provenance in JSON and Markdown reports without fetching remote policy content.
- Added local audits for extension directories and ZIP, XPI, or CRX packages.
- Added Manifest V3, metadata, icon, permission, host-access, CSP, remote-code, update URL, and package-debris findings for Chrome, Firefox, and Edge review.
- Added deterministic package fingerprints, stable finding codes, Markdown and JSON reports, safe archive limits, replacement-safe output, and CI-friendly exit codes.
Quick start
The shortest documented path into the current release.
Before running these source commands, download the v1.3.0 source archive, extract it, and open a terminal in the extracted project folder containing README.md. Follow the tagged README for required runtimes and any platform-specific setup.
python -m pip install .
extension-store-audit path/to/extension.zip
extension-store-audit path/to/unpacked --target chrome --target edge --format json --output audit.json
extension-store-audit path/to/extension.zip --policy examples/policy-profile.json --format json --output current.json
extension-store-audit path/to/extension.zip --policy examples/policy-profile.json --baseline previous.jsonExit code 0 means no static errors, 1 means the report contains errors requiring correction, and 2 means the package or command could not be analyzed. Existing reports are never overwritten.
Current limitations
These boundaries are part of the product and prevent the page from implying unverified capability.
The checks are conservative static heuristics, not legal advice or a guarantee of marketplace acceptance. Store policies and reviewer practices change. A policy profile is only as accurate as its sources, review date, and operator-authored requirements. Permission usage cannot always be proven from bundled code, minified code can reduce evidence quality, and a clean report does not replace current policy review, functional testing, privacy disclosures, screenshots, reviewer credentials, or human inspection.
Privacy and licensing
Review the actual data boundary before using a tool with sensitive inputs.
Privacy and safety
Everything runs locally. The auditor does not upload packages, execute extension code, contact URLs found in the package or policy profile, use telemetry, or require an account. ZIP paths, duplicate names, file counts, and uncompressed sizes are checked before analysis.
License and release
Extension Store Readiness Auditor is published under MIT. The current cataloged release is v1.3.0, published 2026-10-16.
Related projects
Related projects are selected deterministically from shared catalog tags, category, and implementation technologies—not popularity or paid placement.
Extension Store Readiness Auditor v1.3.0
Use the tagged release for downloads and release notes. Use the repository for source, issues, contribution guidance, security reporting, and complete documentation.
Page source: current Forge catalog plus README and CHANGELOG from the canonical GitHub release tag. Fingerprint: 6420588f73ec8e58.