skills.rest
PioneerAIAcademy
PioneerAIAcademyOFFICIAL
Explore all skills by this author →
GitHub

security-invariants

Audits Electron main, preload, and IPC code against a ten-item security checklist.

3|3|Updated Apr 8, 2026
Search Tags:#code review#CSP#security audit#desktop app#Electron#IPC#preload
One-click install
npx skills add https://github.com/PioneerAIAcademy/cowork-genealogy --skill security-invariants-pioneeraiacademy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-invariants
Source: https://github.com/PioneerAIAcademy/cowork-genealogy/tree/main/apps/electron/.claude/skills/security-invariants
Command: npx skills add https://github.com/PioneerAIAcademy/cowork-genealogy --skill security-invariants-pioneeraiacademy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Electron apps expose a large attack surface when renderer, preload, and main-process boundaries are misconfigured. This Skill verifies that the Research Viewer desktop app still enforces its non-negotiable security baseline before any PR touching main/preload code, IPC channels, CSP, or dependencies, and before tagging a release. ## Core Features & Use Cases - Ten-Invariant Audit: Checks BrowserWindow webPreferences, HTTP-header CSP, preload contextBridge allowlist, IPC input validation, navigation/window blocking, absence of the remote module, unsafe HTML rendering, secrets hygiene, minimal dependencies, and macOS hardened runtime entitlements. - Evidence-Based Reporting: Each item reports PASS or FAIL with file and line-number citations, ending in a summary like "10/10 PASSED". - Use Case: Before merging a branch that modified src/main/index.ts or added an IPC channel, run the check to confirm no sandbox escape, CSP regression, or unauthorized preload channel was introduced. ## Quick Start Run the security invariants check on the current Electron source and report PASS or FAIL for each item.

Frequently Asked Questions about security-invariants

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I security review an Electron app before release?▼

Run a checklist audit of BrowserWindow webPreferences, CSP headers, the preload contextBridge allowlist, IPC input validation, and macOS entitlements. This Skill reads the actual source files and reports PASS or FAIL per item with file:line evidence.

What webPreferences settings make an Electron BrowserWindow secure?▼

Set contextIsolation: true, nodeIntegration: false, sandbox: true, webSecurity: true, and allowRunningInsecureContent: false. These five settings prevent a renderer XSS from reaching Node.js APIs or escaping the Chromium sandbox.

Why should CSP be set via HTTP header instead of a meta tag in Electron?▼

Header-based CSP is authoritative because of CVE-2023-23623, which affects meta-tag-only policies. The Skill checks the onHeadersReceived header in src/main/index.ts and requires the meta tag in index.html to stay in sync with it.

How do I safely expose IPC to an Electron renderer?▼

Use contextBridge.exposeInMainWorld with a fixed allowlist of named functions, never expose raw ipcRenderer, and use only hardcoded channel names. Every ipcMain.handle must validate renderer inputs since the renderer is untrusted.

When should this security check be run?▼

Run it before any PR touching src/main/, src/preload/, IPC channels, CSP, or package.json dependencies, and before tagging a release. It is a manual audit skill, not an automated CI gate.

Related Skills

Explore More Software Engineering Skills→
gouravsingh311gouravsingh311

electron-ipc

Orchestrate Electron IPC communication between main and renderer processes.

Community
Intermediate
VvanlaarVvanlaar

build-desktop

Automate version bumping, building, and packaging for Electron desktop apps.

Community
Advanced
Arete-ConsortiumArete-Consortium
4

health

Audits project health across tests, dependencies, code quality, documentation, CI/CD, and security.

Official
Intermediate
roanbrasilroanbrasil
5

static-analysis

Automate static analysis for Java, Kotlin, Python, and Rust codebases.

Community
Advanced