# Chrome Extension Security Risk Scraper (`googleapi/chrome-extension-security-risk-scraper`) Actor

Score public Chrome extensions using permission, host, privacy, and update signals.

- **URL**: https://apify.com/googleapi/chrome-extension-security-risk-scraper.md
- **Developed by:** [Google API](https://apify.com/googleapi) (community)
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.99 / 1,000 results

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

This Actor collects public Chrome Web Store extension listing data and derives a transparent, heuristic security-triage signal from structured manifest permissions and the developer’s own privacy disclosures. It does not inspect installed software, execute extensions, or perform a security audit.

### What it collects

Each normal dataset row represents one extension. The rich output includes:

- Listing identity, canonical extension URL, title/name, category, full Overview text, safe formatted HTML, and short description.
- Publisher name, Offered by value, website, email(s), phone, postal address components, D-U-N-S identifier, trader status, and publisher trust badge when shown.
- Rating and rating count, user count, extension version, manifest version, last-updated text/date, size, language count/list, in-app-purchase feature, icon, and screenshots when present.
- Required and optional API permissions; required and optional host patterns; content-script matches; readable permission details when the source has a dedicated permission section; evidence objects and evidence completeness.
- Developer privacy-section text, privacy-policy link, collection/use declaration, third-party sale declaration (including qualified exceptions), unrelated-use and creditworthiness declarations.
- Related extension IDs, titles, and canonical URLs scoped to the listing’s Related section.
- Risk score, level, factors, assessment status, and method. When structured permission evidence is absent, the score is `null`, the level is `insufficient_evidence`, and site access is `unknown`—not “low risk.”

The dataset includes the public extension listing, permission evidence, privacy disclosures, related extensions, and the risk assessment. Missing or unavailable source information is not filled with guesses.

### Source coverage and limits

Provide extension IDs or official detail URLs for specific extensions, or search/category URLs to discover candidates. This Actor reads the initial search/category page only; the Chrome Web Store's additional results load interactively, so `page` and `maxPages` must remain at 1. Permission information is included only when structured public declarations are available; it is not inferred from advertising text.

### Input

Provide an extension ID in `extensionIds`, public URLs in `startUrls`, or search terms in `queries` (`query` or `searchQuery` for one term). Example:

```json
{
  "extensionIds": ["cjpalhdlnbpafiamejdnhcphjbkeiagm"],
  "maxItems": 5,
  "maxDetailRequests": 5,
  "maxRequests": 10,
  "page": 1,
  "maxPages": 1
}
```

Supported URL routes are Chrome Web Store detail, search, and category pages. `maxItems` limits extension records and `maxDetailRequests` limits detail pages. Only the initial public search/category page is supported.

### Output and dataset

Each dataset row represents one extension. The `💼 Security Risk Overview`, `🔐 Permissions and Host Access`, `⚠️ Risk Explanation and Privacy`, and `🔍 Listing and Publisher Details` views help you browse the results.

The dataset and run summary are available in the Output tab. You can download dataset records in formats such as JSON, HTML, CSV, or Excel. If a page is blocked, empty, malformed, or unavailable, it is reported in the run summary and logs rather than added as an extension record.

### Limits and responsible use

The Actor reads public Web Store pages only. It does not sign in, bypass access controls, solve CAPTCHAs, or resolve privacy-policy sites. Risk weights are heuristic and uncalibrated; they are intended only for triage and must not be treated as a security verdict, malware finding, or endorsement.

An ID or detail-URL lookup normally uses one detail request per extension. Search/category inputs use a listing request plus detail requests for discovered extensions. Retries count toward `maxRequests`; compute and platform usage depend on the requested records and current Apify plan. Start with a small `maxItems` and request budget when evaluating the Actor.

For questions or product feedback, use the Actor’s Apify support/issues channel.

# Actor input Schema

## `extensionId` (type: `string`):

One public extension ID. The Actor fetches its official detail route directly by ID.

## `extensionIds` (type: `array`):

Public extension IDs to fetch directly from their official detail routes.

## `startUrls` (type: `array`):

Public Chrome Web Store detail, search, or category URLs. Bare /detail/<id> URLs are normalized to the official ID-based detail route.

## `sourceUrls` (type: `array`):

Alias for startUrls.

## `urls` (type: `array`):

Alias for startUrls.

## `queries` (type: `array`):

Public Chrome Web Store search terms.

## `query` (type: `string`):

One search term.

## `searchQuery` (type: `string`):

Alias for query.

## `category` (type: `string`):

Optional Chrome Web Store category slug.

## `locale` (type: `string`):

Accepted for compatibility with locale-aware callers.

## `language` (type: `string`):

Alias for locale.

## `maxItems` (type: `integer`):

Maximum number of risk records.

## `maxPages` (type: `integer`):

The live Chrome Web Store search continues through an interactive Load more control; this Actor currently processes only the initial page. Keep this value at 1.

## `maxRequests` (type: `integer`):

Maximum direct public page requests.

## `maxDetailRequests` (type: `integer`):

Maximum extension detail pages to inspect.

## `requestTimeoutSecs` (type: `integer`):

Maximum wait for each public request.

## `timeoutSecs` (type: `integer`):

Alias for requestTimeoutSecs.

## `requestTimeoutMs` (type: `integer`):

Millisecond form of the request timeout.

## `requestDelayMs` (type: `integer`):

Delay between public requests.

## `maxRetries` (type: `integer`):

Maximum retry attempts for failed requests.

## `userAgent` (type: `string`):

Optional ordinary browser user agent.

## `proxyConfiguration` (type: `object`):

Compatibility field only. This Actor currently uses direct public requests and does not apply Apify proxy settings.

## `page` (type: `integer`):

Only page 1 is currently supported because Chrome Web Store pagination is client-side.

## Actor input object example

```json
{
  "maxItems": 25,
  "maxPages": 1,
  "maxRequests": 50,
  "maxDetailRequests": 25,
  "requestTimeoutSecs": 25,
  "requestDelayMs": 0,
  "maxRetries": 1,
  "page": 1
}
```

# Actor output Schema

## `dataset` (type: `string`):

No description

## `runSummary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("googleapi/chrome-extension-security-risk-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("googleapi/chrome-extension-security-risk-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call googleapi/chrome-extension-security-risk-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,googleapi/chrome-extension-security-risk-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/JIB3M5LeRdRB7Jl3i/builds/MsIaDjFb4hcuzxFdP/openapi.json