@grant requirements?

[JasonBarnabe]

http://wiki.greasespot.net/@grant

Is it useful to make scripts declare @grant? Perhaps detect what they need and add the meta ourselves, which would help against obfuscation of malicious code?

[cletusc]

From my understanding, @grant isn't required at my moment, but GM does notify when a script is missing them. I would, if possible, detect all of the standard @grant things and offer to add them if they are missing, or suggest what to do. In the case where none are detected (or needed), offer to add @grant none.

@grant isn't required now, but it would be nice if in the future it would be--why not have a host lead the way and get this stuff standardized as much as possible? As with the other stuff, don't disallow a script, but warn with a "save anyway" option (edit: and if GM makes it required one day, it should be changed here too).

[grant]

🐵 👍

[cletusc]

For reference, here is how GM sniffs out the @grants.

[supahgreg]

FWIW, Scriptish does require @grant

[jerone]

FWIW, Scriptish does require @grant

Scriptish doesn't require @grant. This blog post from Juli 2013 says it is required, but the code says not.
Here's how Scriptish sniffs out the @grant's

[cletusc]

GM no longer sniffs grants by default.

[JasonBarnabe]

What Greasemonkey doing is reasonable now, and I don't see any APIs that jump out at me at being so out of line that I'd want to block scripts that used them, so I don't see the need to do anything here.