Agent Wranglers

DSK-14Required

Ask for the fewest permissions the extension needs

Request only permissions the extension uses, and prefer activeTab to host permissions. Put features that a minority of users turn on under optional_permissions or optional_host_permissions, asked for when the user starts them.

By Agent Wranglers. Updated .

How to do it

An extension with <all_urls> reads every page the user opens, including their bank and email. A hijacked update then reaches all of it. activeTab gives access to the current tab only after the user clicks the extension, and shows no install warning. Chrome Web Store reviewers ask for a reason for each permission, and Mozilla's policies allow only permissions the add-on needs. List exact hosts, such as https://api.example.com/*, instead of wildcards. Remove a permission the same day its feature goes, and review the list as give each key the least power does for keys.

Examples

JSON example

{
  "manifest_version": 3,
  "name": "Ledgerly Clipper",
  "permissions": ["activeTab", "scripting", "storage"],
  "optional_host_permissions": ["https://invoices.example.com/*"],
  "host_permissions": ["https://api.example.com/*"]
}

How to check

A CI script compares the manifest with an approved list of permissions and hosts, and fails on anything new. The manifest has no <all_urls>, *://*/* or tabs unless the approved list gives a written reason. Each permission has a line in the store's justification form.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/browser-extensions/extension-permissions">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.