--- name: browser-extension-control-3931d51756db description: "Build, edit, install or audit Chrome Web Store extensions in Agent Zero Browser." triggers: - "build browser extension" - "modify browser extension" - "extension permissions" --- # Agent Zero Browser Extensions Use this skill when the user wants to create a new Browser extension, modify an existing extension, or install a Chrome Web Store extension for Agent Zero's direct `_browser` plugin. ## Operating Model - Agent Zero loads Browser extensions from unpacked directories. - Create user-owned extensions under `/a0/usr/browser-extensions//`. - Browser extension paths must be visible inside the Docker runtime. Prefer `/a0/usr/browser-extensions/...` paths over host-only paths. - The Browser puzzle menu can open "My Browser Extensions", seed a "+ Create New with A0" request, and install Chrome Web Store URLs. - Chrome Web Store installs are converted into unpacked extension folders before Browser can load them. - Extension setting changes restart active Browser runtimes so Playwright can relaunch Chromium with the extension arguments. ## Safety First Browser extensions run inside the Docker browser sandbox, but malicious or buggy extensions can still damage that sandboxed environment, corrupt browser profiles, exfiltrate page data visible to the Browser, or make browsing unreliable. Before creating or installing an extension: - State the requested behavior in one sentence. - List the minimum permissions and host permissions needed. - Avoid `` unless the user explicitly needs broad page access. - Avoid remote code, eval-style execution, hidden credential collection, and broad network access. - Do not store secrets in extension files. - Prefer content scripts for page-local behavior and service workers for coordination. - Tell the user when an extension can read or modify page content. ## Create New Extension 1. Ask for the extension name, user-visible purpose, target websites, and whether it needs a popup, content script, background service worker, options page, or side panel. 2. Choose a lowercase slug such as `reader-highlighter`. 3. Create `/a0/usr/browser-extensions//manifest.json`. 4. Add only the files the extension actually needs. 5. Validate JSON syntax and confirm `manifest_version` is `3`. 6. Keep generated code small, readable, and easy for the user to audit. 7. After creating the folder, tell the user to open Browser's puzzle menu, use "Browser Extension Settings", enable extensions, and include the new folder path if it is not already enabled. Minimal Manifest V3 starter: ```json { "manifest_version": 3, "name": "Agent Zero Example Extension", "version": "0.1.0", "description": "Small, auditable Browser extension created with Agent Zero.", "permissions": [], "host_permissions": [], "action": { "default_title": "A0 Extension" } } ``` Content script starter: ```json { "manifest_version": 3, "name": "Agent Zero Page Helper", "version": "0.1.0", "description": "Adds a small page helper for specific sites.", "permissions": [], "host_permissions": ["https://example.com/*"], "content_scripts": [ { "matches": ["https://example.com/*"], "js": ["content.js"], "run_at": "document_idle" } ] } ``` ## Install From Chrome Web Store If the user gives a Chrome Web Store URL or extension id: 1. Confirm they understand the sandbox warning. 2. Extract the 32-character extension id from the URL. 3. Prefer the Browser puzzle menu's URL installer for direct installs. 4. If installing manually, download the CRX from Chrome's update service, extract the ZIP payload safely, and place it under `/a0/usr/browser-extensions/chrome-web-store//`. 5. Inspect `manifest.json` and summarize name, version, permissions, host permissions, and suspicious capabilities. 6. Enable only after the user accepts the risk. Common URL shapes: ```text https://chromewebstore.google.com/detail/name/ https://chrome.google.com/webstore/detail/name/ ``` ## Review Checklist - `manifest.json` parses cleanly. - Every permission has a reason. - Host matches are specific. - No credential scraping, hidden data upload, or remote executable code. - UI text is concise and tells the truth. - The extension can be removed by deleting its folder from `/a0/usr/browser-extensions/` and removing the path from Browser settings. --- Source attribution: agent0ai Original project: https://github.com/agent0ai/agent-zero License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Dave AI. ## Upstream license notice MIT License Copyright (c) 2026 Gabriel Moreira Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Dave AI resource metadata Creator / publisher: agent0ai Original project: https://github.com/agent0ai/agent-zero Attribution basis: Upstream repository explicitly recorded in package mirror path Fields of work: Design, Development & Engineering, Product Management Roles: Frontend Developer, Product Manager, UX Designer Specialties: Frontend Tools: Docker, Chrome Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: b23a214aa2712e5e5b779c06049e164e131be386fc0ff98a6e97d36d70f37411