Browser Extension Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…
Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research.
Install Browser Extension Reverse
$ npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install sickn33/agentic-awesome-skills browser-extension-reverse --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/browser-extension-reverse .claude/skills/browser-extension-reverse && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "browser-extension-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/browser-extension-reverse into .claude/skills/browser-extension-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "browser-extension-reverse", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/browser-extension-reverseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install sickn33/agentic-awesome-skills browser-extension-reverse --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/browser-extension-reverse .agents/skills/browser-extension-reverse && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "browser-extension-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/browser-extension-reverse into .agents/skills/browser-extension-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "browser-extension-reverse", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install sickn33/agentic-awesome-skills browser-extension-reverse --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/browser-extension-reverse .cursor/skills/browser-extension-reverse && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "browser-extension-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/browser-extension-reverse into .cursor/skills/browser-extension-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "browser-extension-reverse", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/sickn33/agentic-awesome-skills.git --path skills/browser-extension-reverse--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install sickn33/agentic-awesome-skills browser-extension-reverse --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/browser-extension-reverse .gemini/skills/browser-extension-reverse && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "browser-extension-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/browser-extension-reverse into .gemini/skills/browser-extension-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "browser-extension-reverse", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install sickn33/agentic-awesome-skills browser-extension-reverseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/browser-extension-reverse .github/skills/browser-extension-reverse && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "browser-extension-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/browser-extension-reverse into .github/skills/browser-extension-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "browser-extension-reverse", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install sickn33/agentic-awesome-skills browser-extension-reverse --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/browser-extension-reverse .opencode/skills/browser-extension-reverse && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "browser-extension-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/browser-extension-reverse into .opencode/skills/browser-extension-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "browser-extension-reverse", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
browser-extension-reverse- GitHub stars
- 47k
- Used in
- 1 other repo
- Token cost
- ~695 tokens
- SKILL.md length
- 224 words
- Files
- 2 (incl. references)
- Skills in repo
- 1,354
- Repo updated
- First seen
- Licence
- MIT
At a glance
Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research.
- Works in 3 steps: 包体 → 逻辑 → 动态
- Tasks that involve Browser extensions
- SKILL.md covers When to Use, 适用场景, 工作流 and 工具链, plus 4 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Browser Extension Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research.
Its SKILL.md is about 700 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/extension-analysis.md`).
It sits in Security, covering Browser extensions and Reverse engineering and malware. It works with Chrome Extensions. The repository describes itself as: AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,400+ agentic skills. Includes… The licence is MIT.
When your agent uses it
- Tasks that involve Browser extensions
- Tasks that involve Reverse engineering and malware
Example prompts
- “/browser-extension-reverse”
Workflow steps
3 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit ec02547. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Browser Extension Reverse loads about 695 tokens when it runs, and up to ~777 if it reads all its reference files. Until then it costs about 50 tokens; SKILL.md has 224 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from sickn33/agentic-awesome-skills at commit ec02547, republished under its MIT licence (© sickn33). 224 words, ~695 tokens.
Download SKILL.mdSave it as
.claude/skills/browser-extension-reverse/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- browser-extension-reverse
- description
- Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research.
- risk
- offensive
- source
- https://github.com/zhaoxuya520/reverse-skill
- source_repo
- zhaoxuya520/reverse-skill
- source_type
- community
- date_added
- 2026-08-25
- license
- MIT
- license_source
- https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
Browser Extension Reverse Engineering
When to Use
- Auditing a browser extension's behavior and permissions in an authorized review.
- Investigating how an extension handles credentials or sensitive page data.
适用场景
- Chrome/Edge MV2/MV3 扩展分析
- Firefox 扩展
- 恶意扩展 IOC、供应链扩展投毒调查
- 扩展实现的签名/加密/代理逻辑还原
工作流
1. 包体
□ crx 解压 / 从 profile 取扩展目录
□ manifest.json：permissions、host_permissions、background、content_scripts
□ 评估过度权限（<all_urls>、webRequest、debugger）2. 逻辑
□ service_worker / background 入口
□ content_script 注入点与世界（isolated）
□ chrome.storage / IndexedDB 密钥
□ 与 `js-reverse` 相同：Observe 网络与消息传递（runtime.sendMessage）3. 动态
□ 开发者模式加载解压目录
□ chrome://extensions 检查错误
□ DevTools 附加 service worker
□ 必要时 Frida/浏览器 CDP（jshookmcp）工具链
| 工具 | 用途 |
|---|---|
| 解压/jq | manifest |
| Chrome DevTools | worker 调试 |
| js-reverse 工具链 | 深度 JS |
| YARA | 恶意扩展规则 |
参考
references/extension-analysis.md- field-journal 扩展恢复相关条目
../js-reverse/../malware-analysis/
路由上下文
上游: MASTER R30
下游: 复杂混淆 JS → js-reverse；投毒调查 → supply-chain / malware
任务完成自检
- 是否列出权限面与入口脚本？
- 是否还原关键数据流？
- Checklist？
Limitations
- Extension stores update frequently; findings can go stale.
- Dynamic analysis requires a profile isolated from personal accounts.
Adapted from zhaoxuya520/reverse-skill (MIT).
© sickn33, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (references) in skills/browser-extension-reverse of sickn33/agentic-awesome-skills.
- SKILL.md
- references/extension-analysis.md
Open the folder on GitHubat commit ec02547
Used in 1 other repository
We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in sickn33/agentic-awesome-skills, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Browser Extension Reverse next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Browser Extension Reverse this skillsickn33/agentic-awesome-skills | 47k | 1 repos | ~695 | Automated safety check: Pass | MIT | |
| Browser Extension Reversezhaoxuya520/reverse-skill | 40k | 2 repos | ~366 | Automated safety check: Pass | MIT | |
| Canvas Capture Extensionremotion-dev/remotion | 62k | — | ~903 | Automated safety check: Pass | Custom licence | |
| Wxt Browser Extensionsvantezzen/skip-silence | 468 | 2 repos | ~1.9k | Automated safety check: Pass | MIT | |
| Kimi WebbridgeMoonshotAI/kimi-code | 7.8k | — | ~3.6k | Automated safety check: Pass | MIT | |
| Repomix Browser Extension Developeryamadashy/repomix | 29k | 1 repos | ~288 | Automated safety check: Pass | MIT |
Similar skills
- Official
Canvas Capture Extension
remotion-dev/remotion
Rebuild, install, and reload the private Remotion Canvas Capture unpacked Chrome extension.
Wxt Browser Extensions
vantezzen/skip-silence
WXT browser extension performance optimization guidelines. An agent skill from vantezzen/skip-silence.
Kimi Webbridge
MoonshotAI/kimi-code
Kimi Browser Extension（Kimi 浏览器扩展，原 Kimi WebBridge）lets AI control the user's real browser — navigate, click, type, read, screenshot, and interact with any website using the user's actual login…
Repomix Browser Extension Developer
yamadashy/repomix
Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content…
Deepseek Automation
zhu1090093659/deepseek-pp
A skill your agent uses when implementing, resuming, reviewing, or verifying the DeepSeek++ Codex-style automation feature in this repository.
More from sickn33/agentic-awesome-skills
All 1,354 skills in this repoLiuguang Banlan UI
sickn33/agentic-awesome-skills
Implements an interface in one of two named color modes, iridescent white or colorful black, from a parameterized starter that reports measured color intensity.
User Thoughts Memory
sickn33/agentic-awesome-skills
Saves a user's project decisions, rules and preferences into a project-local mdbase so later sessions and other agents can recover the intent.
Using LWC Memory and Graphs
sickn33/agentic-awesome-skills
Keeps project decisions, research and verified results available across coding-agent sessions through LWC memory, a document Wiki graph and a CodeGraph code index.
Find Complementary Founders
sickn33/agentic-awesome-skills
Guides an agent through assessing its own owner for cofounder fit, publishing an approved profile, and ranking complementary profiles other agents published for their owners.
Cline Pilot
sickn33/agentic-awesome-skills
Acts as a proxy for the Cline CLI, dispatching coding tasks one at a time, monitoring runs by hard evidence, relaying decisions to you and learning per-project preferences.
Content Creator
sickn33/agentic-awesome-skills
Drafts and reviews audience-specific content from supplied brand examples, with local scripts for brand voice and SEO diagnostics, channel templates and a content calendar.
Related
Works with
Categories
Questions about Browser Extension Reverse
What does Browser Extension Reverse do?
Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research. Browser Extension Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized reverse engineering of Chrome/Firefox extensions: manifest analysis, background workers, content scripts, and extension-based credential or data-exposure research.
When should I use Browser Extension Reverse?
Browser Extension Reverse fits situations like: tasks that involve Browser extensions; tasks that involve Reverse engineering and malware.
How do I install Browser Extension Reverse in Claude Code?
Run `npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a claude-code`. Or copy the skill folder (skills/browser-extension-reverse in sickn33/agentic-awesome-skills) into .claude/skills/browser-extension-reverse in your project. Claude Code loads it when a task matches its description.
How do I install Browser Extension Reverse in Codex?
Run `npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a codex`. Or copy the skill folder (skills/browser-extension-reverse in sickn33/agentic-awesome-skills) into .agents/skills/browser-extension-reverse in your project. Codex loads it when a task matches its description.
Can I use Browser Extension Reverse in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add sickn33/agentic-awesome-skills --skill browser-extension-reverse -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/browser-extension-reverse, .gemini/skills/browser-extension-reverse, .github/skills/browser-extension-reverse and .opencode/skills/browser-extension-reverse in your project.
What does Browser Extension Reverse need to run?
SKILL.md names no scripts, command-line tools or credentials: Browser Extension Reverse is instructions for the agent only.
Does Browser Extension Reverse access the network?
SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.
Is Browser Extension Reverse safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Browser Extension Reverse use?
Browser Extension Reverse is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Browser Extension Reverse use?
About 695 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 82 tokens, read only when the agent opens those files.
What are the alternatives to Browser Extension Reverse?
Skills that share tags, products or a category with Browser Extension Reverse: Browser Extension Reverse (zhaoxuya520/reverse-skill, 40k stars), Canvas Capture Extension (remotion-dev/remotion, 62k stars), Wxt Browser Extensions (vantezzen/skip-silence, 468 stars) and Kimi Webbridge (MoonshotAI/kimi-code, 7.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Browser Extension Reverse?
sickn33 (a GitHub user) maintains it in sickn33/agentic-awesome-skills, which has 47,343 GitHub stars. The repository holds 1,354 skills in this directory. The repository was last updated on October 7, 2026.
Source: sickn33/agentic-awesome-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.