← Chrome extension permission checker
CRXcavator, from
Duo Security (now part of Cisco), takes a
Chrome Web Store extension ID -- or an uploaded .crx file -- and produces a risk score
from the packaged extension's requested permissions, Content Security Policy, retire.js findings, and
webstore listing metadata. It is aimed at a security or IT team deciding whether an extension someone
else built and published is safe to allow.
This checker is a different job entirely. It is a free, zero-dependency tool -- usable in the browser
with no upload, or as a Node CLI -- that reads your own extension's source tree and
its manifest.json, before you have submitted anything to the Chrome Web Store. It scans
for chrome.* API calls in your JavaScript/TypeScript and cross-checks them against the
permissions, optional_permissions, and host_permissions your manifest
declares, naming any declared-but-unused permission (Google's documentation cites this as the most
common review rejection, "Purple Potassium") and any API call whose permission was never declared
(a runtime failure, not just a review problem).
| What you are trying to do | Where to do it |
|---|---|
| Decide whether to trust an already-published extension you did not write, for your own use or your organization's. | CRXcavator -- it scans the published .crx and webstore listing and returns a risk score, no source access needed. |
| Find out why your own unpublished extension might get rejected for an unused permission, or fail at runtime on a missing one. | This checker -- it reads your source and manifest directly, before you submit anything. |
| Score an extension's Content Security Policy, webstore rating, or third-party library versions. | CRXcavator -- none of that is something this checker looks at; it is permissions only. |
| Reconcile a manifest against the code behind it, line by line, with no publish step and nothing uploaded. | This checker -- the browser tool reads local files with the File API and never sends them anywhere; the CLI makes no network call. |
| Vet a list of extensions already installed across an organization's browsers. | CRXcavator -- it is built for exactly that fleet-review use case; this checker has no fleet or inventory feature. |
These fit different points in an extension's life rather than competing for the same one. A team building its own extension can run this checker before every submission to catch a permission mismatch early, and separately run something like CRXcavator over the third-party extensions it is deciding whether to trust. Neither replaces the other.
They look at extensions from opposite sides. CRXcavator, built by Duo Security (now part of Cisco), takes a Chrome Web Store extension ID or an uploaded .crx and produces a risk score from its packaged code, requested permissions, Content Security Policy, and webstore metadata -- it is built for a security or IT team deciding whether to trust an extension someone else published. This checker takes your own extension's source tree and manifest.json, before you have published anything, and cross-checks the chrome.* APIs your code actually calls against the permissions you declared. Reach for CRXcavator when you are vetting a third-party extension you did not write. Reach for this when you are the one writing the extension and want to catch a 'Purple Potassium' unused-permission rejection, or a missing permission that would fail at runtime, before you submit.
Being free is not the difference, and this page does not claim it is: CRXcavator is a free tool. The difference is what each one needs and what it can see. CRXcavator needs a published extension -- it scans the packaged .crx and the Chrome Web Store listing, so it cannot run against an extension that only exists on your disk. This checker needs your source and your manifest, and nothing else: no upload, no Chrome Web Store listing, no publish step first. It is built for the moment before you have anything to submit, which is exactly the moment a risk-scoring tool for already-listed extensions cannot help with.
Because they answer different questions about permissions. CRXcavator's score tells a reviewer or an IT team how much access an already-published extension is asking for, weighed against its other signals -- useful for deciding whether to allow it. This checker tells the developer of an unpublished extension which specific declared permission has no matching chrome.* call in their own code (the exact shape of Chrome's most-cited rejection reason) and, in the other direction, which API call has no permission declared for it at all, which is a runtime failure waiting to happen. A risk score is a verdict about trustworthiness; this is a line-by-line reconciliation between a manifest and the code behind it.
No. This site is not affiliated with, endorsed by, or sponsored by Cisco Systems or Duo Security, and CRXcavator is named here only to describe what this checker is and is not. The description of CRXcavator on this page is drawn from its own public site; check it there for what it currently scores and how.