Most B2B data and scraping Chrome extensions ask for <all_urls> or broad background host permissions. That creates two huge problems:
- Security & Trust: Engineering teams and growth operators hesitate to install extensions that can silently read every tab in the background.
- Chrome Web Store Review Friction: Broad host permissions routinely trigger weeks-long manual security audits.
This week, we shipped and published two lightweight B2B intelligence extensions on the Chrome Web Store using strictly activeTab, scripting, and storage — zero host_permissions, zero background service workers, and under 24-hour Chrome Web Store review approval.
Install Both Extensions Free on Chrome Web Store
-
StoreIntel: Shopify Spy & Product CSV Exporter
- Inspect any public Shopify storefront's active theme, catalog size, min/max/average pricing, and installed frontend apps/pixels — or switch to Shopify App Store mode to extract 1-star & 2-star churn reviews cleanly into RFC-4180 CSV or JSON.
-
Skool & Creator Intel: MRR Calculator & CSV Exporter
- Parse
skool.comcommunity pages (and batch-extract 30 communities at once onskool.com/discovery), calculate estimated Monthly Recurring Revenue (MRR) and Annual Run Rate (ARR), surface creator social links, and save targets into a local CSV CRM basket.
- Parse
Privacy Policy & Architecture: All DOM inspection happens locally on the currently open tab only after you click the toolbar icon. Full architecture details: StoreIntel Chrome Privacy Policy.
1. Zero-Permission Execution Pattern (activeTab + chrome.scripting)
In Manifest V3, combining activeTab with chrome.scripting.executeScript gives the extension temporary read access strictly to the single tab the user clicks on — and nothing else:
{
"manifest_version": 3,
"permissions": ["activeTab", "scripting", "storage"],
"action": {
"default_popup": "popup.html"
}
}
When the user clicks Scan Active Tab, popup.js injects a pure inspection function into that tab (world: "MAIN" or standard isolated world reading serialized DOM / JSON endpoints) and renders a searchable table inside the popup. No persistent content scripts are injected across unrelated browsing sessions.
2. Dual-Mode Shopify Storefront + App Store Parser
Public Shopify storefronts expose a standardized catalog endpoint (/products.json?limit=250) alongside frontend theme metadata (Shopify.theme) and third-party integration tags in the DOM.
At the same time, B2B SaaS founders selling to merchants spend hours hunting for frustrated users leaving 1-star complaints on competing Shopify App Store listings. So we designed StoreIntel: Shopify Spy to auto-detect context from location.hostname:
- On any retail Shopify store: extracts theme name, storefront currency, detected frontend pixels/integrations, and up to 250 public products with price, compare-at price, SKU, vendor, availability, and image URLs.
-
On
apps.shopify.com/*: switches to App Store Churn Mode, parsing reviewer merchant names, countries, star ratings, time spent using the app, and raw review complaints straight to CSV.
3. Handling Skool's __NEXT_DATA__ & JSON-Encoded displayPrice
When building Skool & Creator Intel, we noticed Skool stores structured community metadata inside Next.js's <script id="__NEXT_DATA__"> payload — with a subtle catch: nested fields like metadata.displayPrice and metadata.owner are themselves stringified JSON blobs inside the outer JSON object, with prices denominated in cents:
function parseNestedJson(raw) {
if (!raw) return null;
if (typeof raw === "object") return raw;
try { return JSON.parse(raw); } catch (_) { return null; }
}
const displayPriceObj = parseNestedJson(group?.metadata?.displayPrice);
const monthlyPriceUsd = displayPriceObj?.amount
? Math.round(Number(displayPriceObj.amount) / 100)
: 0;
Even better: on skool.com/discovery, props.pageProps.groups contains an array of 30 ranked communities per page. Whenever you scan the discovery directory, our extension extracts all 30 communities into your local CRM basket (chrome.storage.local) in one click, computes members * monthlyPriceUsd, and exports an outbound-ready CSV containing website, X/Twitter, YouTube, and Instagram links.
4. Lesson Learned During Chrome Web Store Review (Yellow Argon)
If you submit extensions to Chrome Web Store, watch out for automated store-listing spam filters (Yellow Argon / keyword stuffing). Even inside a legitimate extension, placing a parenthetical comma-separated list of third-party SaaS brand names in your store listing Description will trigger an instant rejection.
Fix: Describe capabilities naturally without comma-separated brand lists in the store copy — our clean descriptions passed review in under 24 hours.
5. Server-Free Monetization via Gumroad License Verification API
For indie developer tools and micro-SaaS extensions, standing up Stripe webhooks, auth databases, and subscription portals slows down launch by weeks.
Instead, we used a client-side POST request straight from popup.js to Gumroad's public License Verification API (/v2/licenses/verify):
const res = await fetch("https://api.gumroad.com/v2/licenses/verify", {
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({
product_id: GUMROAD_PRODUCT_ID,
license_key: key.trim(),
increment_uses_count: "true"
})
});
Free users get generous row caps (25 products or 15 saved Skool communities per export), while power users can unlock unlimited CSV/JSON exports across all StoreIntel Chrome Extensions with a single $19 lifetime key:
Explore Our Open-Source Cloud Scrapers & Free B2B CSV Samples
If you need bulk cloud automation via n8n, Make.com, Clay.com, or Apify Actors (zero browser needed):
- 5 Free Live B2B Sample CSV Datasets (246 Verified Rows) — Stripe-verified SaaS MRR & Founders, High-MRR Skool communities, YC Founders, Greenhouse/Ashby tech stacks, and 1-star churn leads.
- Full 6-Database B2B CSV Bundle ($49 Instant Download)
- 32 Live B2B Scrapers on Apify Store
- Open-Source n8n, Make.com & Clay.com Hub on GitHub
Top comments (0)