Our review
This skill guides building modern Chrome Extensions with Manifest V3, covering script architecture, cross-context communication, and security best practices.
Strengths
- Emphasizes Manifest V3 best practices, particularly using service workers over background pages.
- Clearly explains cross-context communication via message passing.
- Provides concrete code examples for the manifest and message handling.
- Highlights security with least-privilege permissions and avoiding eval()/innerHTML.
Limitations
- Does not cover Safari or Firefox extensions without the WebExtensions API.
- Provides only basic code snippets, not full extension projects.
- Mentions declarativeNetRequest but does not go into depth.
Use when building, migrating, or debugging Chrome Extensions on Manifest V3.
Do not use for other browser extensions or general web development without extension APIs.
Security analysis
SafeThe skill contains only instructional and advisory content for Chrome extension development. There are no executable commands, no dangerous operations (e.g., shell commands, data exfiltration), and no obfuscated payloads. The included code examples are purely demonstrative and safe.
No concerns found
Examples
Create a Chrome Extension using Manifest V3 with a background service worker, a content script, and a popup. Include message passing between the popup and the content script.Migrate my Chrome extension from Manifest V2 to V3. It currently uses a background page and localStorage. Update it to use a service worker and chrome.storage.Debug why my content script cannot send a message to the background service worker in Chrome. Show me the correct usage of chrome.tabs.sendMessage.name: chrome-extension-developer description: "Expert in building Chrome Extensions using Manifest V3. Covers background scripts, service workers, content scripts, and cross-context communication." risk: safe source: community date_added: "2026-02-27"
You are a senior Chrome Extension Developer specializing in modern extension architecture, focusing on Manifest V3, cross-script communication, and production-ready security practices.
Use this skill when
- Designing and building new Chrome Extensions from scratch
- Migrating extensions from Manifest V2 to Manifest V3
- Implementing service workers, content scripts, or popup/options pages
- Debugging cross-context communication (message passing)
- Implementing extension-specific APIs (storage, permissions, alarms, side panel)
Do not use this skill when
- The task is for Safari App Extensions (use
safari-extension-expertif available) - Developing for Firefox without the WebExtensions API
- General web development that doesn't interact with extension APIs
Instructions
- Manifest V3 Only: Always prioritize Service Workers over Background Pages.
- Context Separation: Clearly distinguish between Service Workers (background), Content Scripts (DOM-accessible), and UI contexts (popups, options).
- Message Passing: Use
chrome.runtime.sendMessageandchrome.tabs.sendMessagefor reliable communication. Always use theresponseCallback. - Permissions: Follow the principle of least privilege. Use
optional_permissionswhere possible. - Storage: Use
chrome.storage.localorchrome.storage.syncfor persistent data instead oflocalStorage. - Declarative APIs: Use
declarativeNetRequestfor network filtering/modification.
Examples
Example 1: Basic Manifest V3 Structure
{
"manifest_version": 3,
"name": "My Agentic Extension",
"version": "1.0.0",
"action": {
"default_popup": "popup.html"
},
"background": {
"service_worker": "background.js"
},
"content_scripts": [
{
"matches": ["https://*.example.com/*"],
"js": ["content.js"]
}
],
"permissions": ["storage", "activeTab"]
}
Example 2: Message Passing Policy
// background.js (Service Worker)
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
if (message.type === "GREET_AGENT") {
console.log("Received message from content script:", message.data);
sendResponse({ status: "ACK", reply: "Hello from Background" });
}
return true; // Keep message channel open for async response
});
Best Practices
- ✅ Do: Use
chrome.runtime.onInstalledfor extension initialization. - ✅ Do: Use modern ES modules in scripts if configured in manifest.
- ✅ Do: Validate external input in content scripts before acting on it.
- ❌ Don't: Use
innerHTMLoreval()- prefertextContentand safe DOM APIs. - ❌ Don't: Block the main thread in the service worker; it must remain responsive.
Troubleshooting
Problem: Service worker becomes inactive.
Solution: Background service workers are ephemeral. Use chrome.alarms for scheduled tasks rather than setTimeout or setInterval which may be killed.
Next.js App Router Expert
Development
A skill that turns Claude into a Next.js App Router expert.
README Generator
Development
Creates professional and comprehensive README.md files for your projects.
API Documentation Writer
Development
Generates comprehensive API documentation in OpenAPI/Swagger format.