At this point, you should already have some ideas of what include.ai Superpowers are and how to use include.ai Superpowers to create user script style automations. In this tutorial, we're going to discuss a few additional details that set include.ai Superpowers apart from traditional user scripts.

If you haven't tried to create an include.ai Superpowers yet, please check out the following tutorial and documentation to get started!

Create a custom Superpower available on any website (9 min)

Where is the Superpower executed?

One core difference is that while user scripts runs in the javascript context of the page itself, include.ai Superpowers can be run in multiple different contexts. include.ai Superpowers offers developers an opportunity to create Javascript that can be run in the chrome extension background, chrome extension content page, and the javascript context of the page itself. By giving explicit control over where your code is being run, developers would be able to create more complex combinations and Superpowers. For a more in-depth discussion on writing custom Javascript, checkout the guide below!

Writing Custom Javascript in Superpowers

Same Origin Policy for APIs + chrome APIs

For traditional user scripts, developers do not have easy way to securely use APIs of their choice with user script. GM.xmlHttpRequest offers access to calling APIs that cross the same origin policy boundaries, but the user scripts content remains accessible by the page itself. With include.ai Superpowers, developers can use APIs directly through the chrome extension background, hence avoiding putting API keys into the page javascript context.

In addition, include.ai Superpowers also has access to the chrome API library that can control the tabs behaviors, history, web navigation and etc. For details, check out the chrome API documentation here:

https://developer.chrome.com/extensions/api_index

The currently available permissions include.ai Superpowers can leverage are the following:

"permissions": [
    "storage",
    "tabs",
    "activeTab",
    "debugger",
    "<all_urls>"
  ],

Need a permission that we don't have yet? Let us know by contacting us at [email protected]

Content Security Policy for Script Injection

Another drawback for traditional user scripts on Chrome is may be subjected to the content security policy of the webpage. For instance, LinkedIn has very strict content security policy. include.ai Superpower can circumvent this problem by instead giving developer options to inject code into the chrome content page, which does not have the content security policy restriction.