vulkro extension-audit

Check installed editor and browser extensions for compromised versions and risky permissions.

vulkro extension-audit                     # code editors only
vulkro extension-audit --include-browser   # editors and browsers

With no path it reads the usual extension lists of VS Code, Cursor, Windsurf and VSCodium. --include-browser adds Chromium-family browsers (per-profile manifest.json files) and Firefox (per-profile extensions.json). Missing locations are skipped. Pass a path to check one manifest file or directory instead.

Rules

ID	What it flags
EXT-001	An installed extension version that is known to be compromised.
EXT-002	Broad permissions: <all_urls>, debugger, webRequestBlocking, or several broad APIs together.
EXT-003	A manifest CSP that allows unsafe-eval or unsafe-inline in script-src.

With --format json, the output also has an extension_inventory object: the paths checked and every extension found (identifier, version, source, ecosystem).

Flags

Flag	Description
[PATH]	One manifest file or a directory holding one.
-f, --format <FMT>	table (default), json, ndjson, sarif and the other output formats.
--include-browser	Also check browser extensions.
--fail-on <LIST>	Severities that exit 1. Default critical,high.
--require-extension	Exit 2 when no extensions are found (useful in CI).

Exit codes

Code	Meaning
0	No findings (or no extensions found, without --require-extension).
1	Findings at or above --fail-on.
2	Malformed JSON, IO failure, or no extensions with --require-extension.

See also: vulkro mcp-audit.