Examples

Real-world permission-auditing scenarios. Every example is runnable Rust; copy any block into a binary, or feed the same manifest to the zovo.one scanner for a full security report.

1. Score a manifest

Audit permissions and hosts in one call, then branch on overall risk.

use permission_auditor::{audit, RiskLevel};

let report = audit(&["activeTab", "storage"], &["https://example.com/*"]);

match report.overall {
    RiskLevel::Low      => println!("safe to install"),
    RiskLevel::Medium   => println!("review before install"),
    RiskLevel::High     => println!("install with caution"),
    RiskLevel::Critical => println!("do not install"),
}

2. Explain every permission

Print a one-line verdict per token — the basis of a security report.

use permission_auditor::audit;

let report = audit(&["tabs", "cookies", "clipboardWrite"], &[]);

for p in &report.permissions {
    println!("{:?} {:<18} {}", p.severity, p.token, p.reason);
}

3. Flag every-site access

A <all_urls> or *://*/* host grant means the extension can read every site you visit. Surface it.

use permission_auditor::{audit, HostBreadth};

let report = audit(&[], &["<all_urls>", "https://mail.google.com/*"]);

let all_sites = report.hosts.iter()
    .any(|h| h.breadth == HostBreadth::AllUrls);

if all_sites {
    println!("WARNING: extension can read every site you visit");
}

4. Compare two extensions

Pick the lower-risk extension by comparing overall RiskLevel.

use permission_auditor::audit;

let a = audit(&["activeTab"], &["https://example.com/*"]);
let b = audit(&["cookies", "webRequest"], &["<all_urls>"]);

let safer = if a.overall <= b.overall { "A" } else { "B" };
println!("install extension {safer}");

5. Single-token lookup

Check one permission without a full audit — handy for quick filters.

use permission_auditor::permission_risk;

let r = permission_risk("cookies");
println!("cookies: {:?} — {}", r.severity, r.reason);

---

Next steps

For a full extension security report — every permission explained, every host flagged, every content script surfaced, with install guidance — paste the extension into the zovo.one scanner.