What a manifest can prove
It can show requested permissions and host patterns. Those declarations support a review of potential session, page, network, and download surfaces, but they do not prove a code path actually uses them.
Read the manifest before the pitch.
Static declarations can evidence capability surfaces, not runtime behavior. This audit never touches Chrome, cookies, passwords, Gmail, X, or any logged-in account.
Manifest V3 JSON
The mapping is declaration-based. `cookies` still requires matching host permission; `scripting` needs host access or activeTab at runtime; password-store import is never inferred from a generic permission name.
No manifest auditedRun the sample to separate declared capability from unsupported product claims.
Static review
——
—MANIFEST VERSION
—PERMISSIONS
—HOST SCOPES
—REVIEW FINDINGS
SOURCE-NAMED SURFACEMANIFEST EVIDENCESTATUS
HOST SCOPE
HUMAN REVIEW QUEUE
—
Password import is a separate claim
The sample manifest contains no declaration that evidences saved-password-store import. Treating `cookies` as proof of password access would collapse two distinct data surfaces and overstate the artifact.