# Extension Manifest

> Generate and validate manifest.json with optimal permissions for Chrome MV3 extensions. Analyzes code to determine minimum permissions. Use when: manifest, permissions, manifest.json.

- Skill: `quangpl/extension-manifest` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add quangpl/extension-manifest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/quangpl/extension-manifest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: quangpl (https://skillmd.com/u/quangpl)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/quangpl/extension-manifest

---


# Extension Manifest & Permissions Generator

Generate the best `manifest.json` based on current extension implementation. Analyze code to determine minimum permissions following Chrome docs and best practices.

## Workflow

1. **Detect** framework: check for `wxt.config.ts`, `plasmo.config.ts`, or raw `manifest.json`
2. **Scan** the extension codebase for Chrome API usage
3. **Map** each API call to its required permission (see `references/api-permission-map.md`)
4. **Generate** manifest.json with minimum required permissions
5. **Validate** against Chrome docs and CWS policies
6. **Report** permission warnings users will see

> **Plasmo projects**: Manifest is auto-generated from code and `package.json`. Override via `plasmo.config.ts`. See https://docs.plasmo.com/

## Docs References

- Manifest reference: https://developer.chrome.com/docs/extensions/reference/manifest
- Permissions list: https://developer.chrome.com/docs/extensions/reference/permissions-list

## Quick Manifest Template

```json
{
  "manifest_version": 3,
  "name": "Extension Name",
  "version": "1.0.0",
  "description": "Brief description. Max 132 chars for CWS.",
  "icons": { "16": "icons/icon16.png", "48": "icons/icon48.png", "128": "icons/icon128.png" },
  "action": { "default_popup": "popup.html", "default_icon": { "16": "icons/icon16.png" } },
  "permissions": [],
  "host_permissions": [],
  "background": { "service_worker": "background.js", "type": "module" }
}
```

## Permission Analysis Steps

1. **Grep codebase** for `chrome.` API calls
2. **Map** each to permission using `references/api-permission-map.md`
3. **Prefer** `activeTab` over `tabs` + host_permissions when possible
4. **Use** optional permissions for non-essential features
5. **Check** warning text in `references/permission-warnings.md`

## Common Mistakes

| Error | Fix |
|-------|-----|
| `host_permissions` inside `permissions` | Move URLs to separate `host_permissions` array |
| Using `<all_urls>` | Narrow to specific domain patterns |
| Missing `activeTab` | Add when only needing current tab on user click |
| `tabs` permission overuse | Only needed for tab URL/title; use `activeTab` instead |
| `content_security_policy` as string | Must be object: `{ "extension_pages": "..." }` |
| `web_accessible_resources` as string[] | Use object with `resources` + `matches` |

## Key MV3 Rules

1. `host_permissions` is separate from `permissions`
2. Service workers replace background pages (no DOM, no `window`)
3. `content_security_policy` is an object, not string
4. Remote code execution banned (no eval, no CDN scripts)
5. `web_accessible_resources` requires `matches` array
6. Use `chrome.scripting.executeScript()` not `tabs.executeScript()`

## References

- `references/manifest-fields-reference.md` - All manifest fields with types and examples
- `references/manifest-templates.md` - Ready-to-use templates (popup, content script, sidepanel, devtools)
- `references/manifest-validation-checklist.md` - Pre-submission validation
- `references/api-permission-map.md` - Chrome API → permission mapping
- `references/permission-warnings.md` - User-facing warning text per permission
- `references/permission-strategies.md` - Optional permissions, activeTab, escalation patterns

## Related Skills

- `extension-create` - Full project scaffolding
- `extension-analyze` - Security audit and best practices