Reviews a browser extension before it goes to the Chrome Web Store or Firefox Add-ons. Paste the manifest, the content scripts, the background service worker, the popup and options pages, and the message handlers to find permissions and host patterns wider than the feature needs, content scripts that trust page data, background handlers that act on any message from any tab or any website, web-accessible resources and externally_connectable entries that open the extension to every origin, remote code and eval, tokens stored where every script can read them, and a Content Security Policy that lets them in. Returns a verdict, a trust map, evidence-linked findings, the smallest fix in the extension's code, and tests that prove it.