Browser Extension Permission Minimality Gate

This Actor finds permissions that an extension manifest declares but the code does not use. Run it before you upload a release to the Chrome Web Store.

Input

Field	Type	Default	Description
packages	array of strings	one Chrome Web Store ID	Up to 20 public ZIP or CRX URLs, or Chrome Web Store extension IDs. Each package must be 50 MB or less.

An empty input {} uses the default value. The run succeeds.

Output

The default dataset has two row types.

Permission row (type: "permission"), one for each declared permission: package, extension_name, extension_version, permission, declared_in, verdict (used, unused, or unknown), api_references, file_paths, note.

Summary row (type: "summary"), one for each package: result (pass or fail), analysis_status, declared_count, used_count, unused_count, unknown_count, unused_permissions, files_scanned, error.

Rules

• result is fail when at least one permission is unused. Otherwise it is pass.
• unknown never causes a fail.
• A package that cannot be analyzed gets result: "fail" and an analysis_status of unreachable, invalid_package, or invalid_input. The error field gives the reason. These are results. The run still ends SUCCEEDED.

Pricing event

Event name	Unit	Price (USD)
package-analyzed	One extension package that was downloaded and scanned	0.03

The Actor makes one Actor.charge call with count 1 for each analyzed package. It does not charge for packages that are unreachable, invalid, or rejected by input checks. If the maximum total charge limit is reached, the Actor stops and keeps the results that it already stored. The default limit of USD 0.60 covers the maximum of 20 packages.

The price is set in the Apify Console. This repository does not change pricing.

How the scan works

1. The Actor downloads the package with HTTP only. It uses no browser, proxy, or paid API.
2. It reads the ZIP or CRX in memory. It does not run any code from the package.
3. It reads manifest.json and the permissions in permissions, optional_permissions, host_permissions, and optional_host_permissions.
4. It scans .js, .mjs, .cjs, and .html files for chrome.* and browser.* API calls.

Limits and safety

• Download limits: 50 MB for each package, 3 redirects, 90 seconds, 4 downloads at a time.
• Archive limits: 5000 files, 250 MB unpacked, 5 MB for each script, 100 MB scanned in total.
• The Actor rejects URLs that use a scheme other than http or https, a port other than 80 or 443, credentials in the URL, or a host that resolves to a private or reserved address. It checks each redirect. The Actor resolves the host name one time for each request. It connects to the address that it approved. It keeps the host name for the Host header and for TLS (Transport Layer Security).
• A static scan can give a wrong answer. The Actor gives unknown, not unused, when: code reads APIs in a dynamic way (for example chrome[name], eval, or const api = chrome;), when some files were too large or unreadable, when the permission has no detectable API (for example unlimitedStorage), for tabs when chrome.tabs calls exist, and for activeTab when chrome.tabs calls, chrome.tabCapture, or a user-action entry point exist. The entry points are action.onClicked, browserAction.onClicked, pageAction.onClicked, contextMenus.onClicked, menus.onClicked, and commands.onCommand.
• Comments and strings that look like API calls count as use. A permission can show used when only a comment names the API.
• A host permission is used when a content script matches it or the host name appears in the code. It is unknown when the code makes network or injection calls. Otherwise it is unused.
• Packages can be remote and untrusted. The Actor never writes archive files to disk.

Local development

uv sync
uv run pytest
uv run ruff check .
apify run --input-file .actor/default_input.json