create-rule
Create Cursor rules for persistent AI guidance. Use when the user wants to create a rule, add coding standards, set up project…
@coco-researchInstall SkillDevelopment
Skill
/browser-extension-reverse
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
Claude Code
$ npx -y skills add coco-research/coco --skill browser-extension-reverse --agent claude-code
Codex
$ npx skills add coco-research/coco --skill browser-extension-reverse -a codex -y
Cursor
$ npx skills add coco-research/coco --skill browser-extension-reverse -a cursor -y
Gemini CLI
$ npx skills add coco-research/coco --skill browser-extension-reverse -a gemini-cli -y
GitHub Copilot
$ npx skills add coco-research/coco --skill browser-extension-reverse -a github-copilot -y
OpenCode
$ npx skills add coco-research/coco --skill browser-extension-reverse -a opencode -y
Windsurf
$ npx skills add coco-research/coco --skill browser-extension-reverse -a windsurf -y
SKILL.md
browser-extension-reverse.SKILL.mdname: browser-extension-reverse description: Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery. user-invocable: true
Browser Extension Reverse Engineering
适用场景
- Chrome/Edge MV2/MV3 扩展分析
- Firefox 扩展
- 恶意扩展 IOC、供应链扩展投毒调查
- 扩展实现的签名/加密/代理逻辑还原
工作流
1. 包体
□ crx 解压 / 从 profile 取扩展目录 □ manifest.json：permissions、host_permissions、background、content_scripts □ 评估过度权限（<all_urls>、webRequest、debugger）
2. 逻辑
□ service_worker / background 入口 □ content_script 注入点与世界（isolated） □ chrome.storage / IndexedDB 密钥 □ 与 `js-reverse` 相同：Observe 网络与消息传递（runtime.sendMessage）
3. 动态
□ 开发者模式加载解压目录 □ chrome://extensions 检查错误 □ DevTools 附加 service worker □ 必要时 Frida/浏览器 CDP（jshookmcp）
工具链
| 工具 | 用途 | |------|------| | 解压/jq | manifest | | Chrome DevTools | worker 调试 | | js-reverse 工具链 | 深度 JS | | YARA | 恶意扩展规则 |
参考
- `references/extension-analysis.md`
- `../js-reverse/` `../malware-analysis/`
Ships withcoco
495 personas across 13 departments, 229 skills[^installed] and 388 commands in the full catalog (coco 1.9.0, 2026-10-21). Agent skills, slash commands and subagents for Claude Code, Cursor, Codex and other AI coding agents.
631200 skills53 agents
Stars on GitHub
Momentum
- stars in total
- 631
Other skills on coco.
@coco-researchInstall Skillcreate-skill
Guides users through creating effective Agent Skills for Cursor. Use when the user wants to create, write, or author a new skill,…
@coco-researchInstall Skillcreate-subagent
Create custom subagents for specialized AI tasks. Use when the user wants to create a new type of subagent, set up task-specific…
@coco-researchInstall Skillmigrate-to-skills
Convert 'Applied intelligently' Cursor rules (.cursor/rules/*.mdc) and slash commands (.cursor/commands/*.md) to Agent Skills…
@coco-researchInstall Skillupdate-cursor-settings
Modify Cursor/VSCode user settings in settings.json. Use when the user wants to change editor settings, preferences,…
@coco-researchInstall Skillagent-lightning
Train and optimize AI agents using Microsoft's Agent Lightning framework with reinforcement learning. Use when setting up agent…
@coco-researchInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about browser-extension-reverse.
- Which coding agents can use browser-extension-reverse?
- browser-extension-reverse installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.