Skip to main content
electron-ipc-security-audit Analyze Electron IPC implementations for security vulnerabilities including contextIsolation, nodeIntegration, preload scripts, and channel validation
Zur Installation springen Skills Marktplatz Entdecken und erkunden Sie KI-Skills, die von der Community erstellt wurden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Prompt-Details anzeigen Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/a5c-ai/babysitter --skill electron-ipc-security-auditDer Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
ZIP herunterladen Herunterladen... Mehr aus diesem Repository Reference for querying the Atlas knowledge graph through its MCP tools — the SECONDARY enrichment/comparison layer that adds best-practice context to systems you have ALREADY scanned from your real sources (`az`, repos, dirs). Use when you need to look up nodes, edges, kinds, clusters, stats, or wiki pages in Atlas to compare against your real inventory. (atlas graph, query atlas, atlas mcp, search the graph, graph neighbors, atlas record, atlas kinds, enrichment layer)
Atlas turns your STATED NEED into a real systems atlas by SCANNING your actual sources (Azure via `az`, git repos, local dirs) and process/data mining them, THEN enriching against the Atlas knowledge graph. Use this skill when asked to inventory/map your real systems, scan your cloud + repos + directories, mine the real processes or data they contain, or collect their real constraints/gotchas. (atlas, scan my systems, inventory our azure account, map my repos, real systems atlas, process mining, data mining, collect nuances, system discovery)
assimilate-popular-workflows This skill should be used when the user asks to "find skills in the wild", "assimilate popular workflows", "discover SKILL.md files in repos", "research external skills", "find workflow patterns", "survey the skill landscape", "what skills exist out there", or wants to investigate public repositories for extractable processes, babysitter plugins, and reusable procedural insights. Searches GitHub for SKILL.md files, classifies repos by archetype, and maintains structured research under docs/reference-repos/.
Verwandte Berufe SOC
Basierend auf der SOC-Berufsklassifikation
name electron-ipc-security-audit description Analyze Electron IPC implementations for security vulnerabilities including contextIsolation, nodeIntegration, preload scripts, and channel validation allowed-tools Read, Grep, Glob, Bash tags ["electron","security","ipc","audit","desktop"] graph {"domains":["domain:software-engineering"],"specializations":["specialization:desktop-development"],"skillAreas":["skill-area:desktop-ui-frameworks","skill-area:cross-platform-desktop"],"roles":["role:desktop-developer","role:fullstack-engineer"],"workflows":["workflow:feature-development","workflow:release-management"]}
electron-ipc-security-audit
Analyze Electron IPC implementations for security vulnerabilities. This skill performs comprehensive security audits of inter-process communication patterns, checking for contextIsolation issues, nodeIntegration risks, preload script security, and IPC channel validation.
Capabilities
Audit IPC channel implementations for security vulnerabilities
Check contextIsolation and nodeIntegration configuration
Analyze preload scripts for unsafe patterns
Validate IPC message handling and sanitization
Detect prototype pollution risks
Check for remote code execution vulnerabilities
Review Content Security Policy headers
Identify exposed APIs through contextBridge
Input Schema {
"type" : "object" ,
"properties" : {
"projectPath" : {
"type" : "string" ,
"description" : "Path to the Electron project root"
} ,
"auditScope" : {
"type" : "array" ,
"items" : {
"enum" : [ "ipc-channels" , "preload-scripts" , "main-process" , "renderer-security" , "csp" , "all" ]
} ,
"default" : [ "all" ]
} ,
"severity" : {
"enum" : [ "all" , "critical" , "high" , "medium" ] ,
"default" : "all" ,
"description" : "Minimum severity level to report"
} ,
"includeRecommendations" : {
"type" : "boolean" ,
"default" : true }
} ,
"required" : [ "projectPath" ]
}
Output Schema {
"type" : "object" ,
"properties" : {
"success" : { "type" : "boolean" } ,
"summary" : {
"type" : "object" ,
"properties" : {
"totalIssues" : { "type" : "number" } ,
"critical" : { "type" : "number" } ,
"high" : { "type" : "number" } ,
"medium" : { "type" : "number" } ,
"low" : { "type" : "number" }
}
} ,
"findings" : {
"type" : "array" ,
"items" : {
"type" : "object" ,
"properties" : {
"id" : { "type" : "string" } ,
"severity" : { "enum" : [ "critical" , "high" , "medium" , "low" ] } ,
"category" : { "type" : "string" } ,
"title" : { "type" : "string" } ,
"description" : { "type" : "string" } ,
"file" : { "type" : "string" } ,
"line" : { "type" : "number" } ,
"recommendation" : { "type" : "string" } ,
"codeExample" : { "type" : "string" }
}
}
} ,
"securityScore" : {
"type" : "number" ,
"description" : "Security score 0-100"
}
} ,
"required" : [ "success" , "findings" ]
}
Security Checks
Critical Checks
nodeIntegration enabled : Check for nodeIntegration: true in BrowserWindowcontextIsolation disabled : Check for contextIsolation: falsesandbox disabled : Check for sandbox: falseDirect ipcRenderer exposure : Check for exposing ipcRenderer without contextBridgeRemote module usage : Check for deprecated remote moduleeval/Function execution : Check for dynamic code execution in IPC handlers
High Severity Checks
Unrestricted IPC channels : Check for ipcMain.on('*') patternsMissing input validation : Check for unsanitized IPC argumentswebSecurity disabled : Check for webSecurity: falseUnsafe protocol registration : Check for custom protocol handlersMissing CSP headers : Check for Content Security Policy
Medium Severity Checks
Overly permissive file access : Check for broad file system accessInsecure web preferences : Check deprecated optionsMissing channel whitelisting : Check preload script exposureNavigation to untrusted URLs : Check navigation handlers
Usage Instructions
Scan project structure : Identify main process, preload, and renderer filesCheck BrowserWindow configurations : Audit webPreferences settingsAnalyze IPC implementations : Review ipcMain/ipcRenderer usageReview preload scripts : Check contextBridge API exposureValidate CSP headers : Ensure proper Content Security PolicyGenerate report : Compile findings with severity and recommendations
Vulnerability Patterns
Critical: Direct ipcRenderer Exposure
contextBridge.exposeInMainWorld ('electron' , {
ipcRenderer : ipcRenderer
});
contextBridge.exposeInMainWorld ('electron' , {
send : (channel, data ) => {
const validChannels = ['file:read' , 'file:write' ];
if (validChannels.includes (channel)) {
ipcRenderer.send (channel, data);
}
}
});
Critical: Missing Context Isolation
new BrowserWindow ({
webPreferences : {
contextIsolation : false ,
preload : path.join (__dirname, 'preload.js' )
}
});
new BrowserWindow ({
webPreferences : {
contextIsolation : true ,
sandbox : true ,
preload : path.join (__dirname, 'preload.js' )
}
});
High: Unrestricted IPC Handler
ipcMain.handle ('execute' , async (event, cmd) => {
return exec (cmd);
});
const ALLOWED_COMMANDS = ['list-files' , 'get-info' ];
ipcMain.handle ('execute' , async (event, cmd, args) => {
if (!ALLOWED_COMMANDS .includes (cmd)) {
throw new Error ('Command not allowed' );
}
return executeWhitelistedCommand (cmd, args);
});
Best Practices
Always enable contextIsolation : Prevents prototype pollutionUse sandbox mode : Restricts renderer process capabilitiesWhitelist IPC channels : Only expose necessary channelsValidate all IPC inputs : Never trust renderer inputAvoid dynamic code execution : No eval/Function in IPC handlersImplement CSP headers : Restrict script sourcesUse invoke/handle pattern : Prefer over send/on for request-response
Related Skills
electron-main-preload-generator - Generate secure boilerplateelectron-builder-config - Build configurationdesktop-security-auditor agent - Comprehensive security review
Related Agents
electron-architect - Architecture guidancedesktop-security-auditor - Security expertise
References 