What are the recommended BrowserWindow security settings included?

The skill enforces critical settings including contextIsolation: true, nodeIntegration: false, sandbox: true, and webviewTag: false to minimize the application's attack surface.

Why is contextBridge used instead of exposing ipcRenderer directly?

Exposing ipcRenderer directly allows a compromised renderer process to send arbitrary messages to the main process. contextBridge creates a secure, isolated bridge that only exposes specific, validated functions.

Does this skill work with React-based Electron apps?

Yes, it includes specialized TypeScript declarations and React hooks (useElectron, useKeychain) to provide a type-safe way to access secure Electron features from a React frontend.

How does this skill handle sensitive API keys?

It provides implementation patterns to store credentials in the operating system's native secure keychain (like macOS Keychain or Windows Credential Vault) instead of insecure locations like localStorage.

Electron Security Patterns

Name: Electron Security Patterns
Author: bradtaylorsf

bybradtaylorsf

•

セキュリティとテスト

Implements robust security protocols for Electron applications, including secure IPC communication and encrypted credential storage.

The Electron Security skill provides a comprehensive framework for building production-grade desktop applications with security-first architecture. It enforces industry best practices such as context isolation, renderer sandboxing, and secure Inter-Process Communication (IPC) via contextBridge. By offering standardized patterns for system keychain integration and navigation restrictions, this skill helps developers prevent Remote Code Execution (RCE) vulnerabilities and ensures sensitive user credentials like API keys are never stored in insecure local storage or plaintext configuration files.

主な機能

01Secure IPC implementation using contextBridge with strict channel validation

02Type-safe React hooks for seamless Electron-to-Renderer communication

03Hardened BrowserWindow configurations with mandatory sandboxing and isolation

04System keychain integration for encrypted API key and credential management

05Navigation security controls to prevent unauthorized external URL loading

066 GitHub stars

ユースケース

01Standardizing secure communication between a React frontend and Node.js main process

02Hardening a cross-platform application to eliminate XSS-to-RCE attack vectors

03Building a desktop AI assistant that requires secure handling of LLM API keys

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add bradtaylorsf/alphaagent-team electron-security

For use in Claude.ai and ChatGPT

Download Skill