Skip to content

permission-auditor

A Chrome extension asks for tabs, cookies, and https://*/*. Is that risky? Every permission token and every host match-pattern maps to a real capability — reading your browsing, reading your accounts, reading every site you visit. Score each one, flag the broad ones, and explain what they do, and an extension install becomes an informed decision instead of a blind click.

permission-auditor is a pure-Rust, zero-dependency crate that audits Chrome / Manifest V3 permissions and host match-patterns for risk. It maps every common API token to a severity (Low / Medium / High) and a short explanation, classifies host grants (specific vs. wildcard vs. <all_urls>), and rolls the whole manifest into a single RiskLevel. It is the risk-scoring layer behind the zovo.one Chrome-extension privacy & security scanner.

Pair it with crx-manifest-parser to decode the manifest first, then hand the permission and host lists here.

How risk is scored

  1. Per-permission severity — each API token (tabs, cookies, activeTab, ...) is looked up in a curated table mapping it to Low / Medium / High plus a one-line explanation.
  2. Host classification — each match-pattern is Specific (https://example.com/*), Wildcard (https://*.example.com/*), or AllUrls (<all_urls> / *://*/*).
  3. Roll-up — the worst permission severity combined with the broadest host class yields an overall RiskLevel.
input output
Vec<&str> perms Vec<PermissionRisk> with severity + reason
Vec<&str> hosts Vec<HostRisk> with breadth class
both AuditReport { overall: RiskLevel, ... }

Severity guide

severity example tokens capability
Low storage, activeTab local state / one tab on user click
Medium tabs, clipboardWrite browsing metadata / clipboard
High cookies, webRequest, <all_urls> accounts / intercept traffic / all sites

Install

[dependencies]
permission-auditor = "0.1"

Quick start

use permission_auditor::{audit, RiskLevel};

let report = audit(
    &["tabs", "cookies"],
    &["https://*/*"],
);

println!("overall risk: {:?}", report.overall);   // High
for p in &report.permissions {
    println!("{:?}: {} — {}", p.severity, p.token, p.reason);
}
assert_eq!(report.overall, RiskLevel::High);

See it live

The crate gives you the score. For a full extension security report — every permission explained, every host flagged, every content script surfaced, with install guidance — paste the extension into the zovo.one scanner.

Features

  • Pure Rust, no deps — a single file, no features, no network.
  • Curated permission table — common MV3 API tokens mapped to severity + explanation; unknown tokens default to a sensible baseline.
  • Host breadth classification — Specific / Wildcard / AllUrls.
  • Overall RiskLevel — one enum for quick branching.
  • Human-readable reasons — every verdict ships with a one-line why.
  • Deterministic — same input always yields identical output.
  • MIT licensed — embed anywhere.