One capability entry such as { "cmd": "powershell", "args": true }, fs:allow-home-write or an asset scope of "$HOME/**" lets any script that gets into your webview run programs, read every file the user owns or plant code in ~/.bashrc. And "csp": null, the create-tauri-app default, is fine for a first build but should be tightened before release, before the app grants that kind of access. This skill finds these and the other Tauri settings that matter before you ship, and tells you how to fix each one.

Your agent runs a scanner on tauri.conf.json, tauri.conf.json5 and Tauri.toml (with their platform and --config files) and on the capability files in src-tauri/capabilities (JSON, JSON5 or TOML). It reads both Tauri 1 (allowlist, tauri > security, tauri > updater) and Tauri 2 (app > security, plugins, capabilities and plugin permissions such as shell:allow-execute, fs:scope and http:default), tells them apart, and knows that a platform file only overrides what it sets. It reads each app's capabilities before judging its CSP, so the stock template gets a REVIEW, not a BLOCK. It allows comments and trailing commas, points at the exact line, and leaves app folders, fixed commands, sidecars and subdomain scopes alone. It never builds or runs your app. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• T01: Tauri 1 allowlist all: true

• T02: shells and interpreters the webview can start with code it chooses (args: true, a validator after -c or -Command), a shell open regex that accepts file paths, opener paths on broad folders

• T03: file or asset scopes over the disk, the home folder, shared app data, credential folders or shell startup and autostart files (**, $HOME/**, $HOME/.ssh, $HOME/.bashrc), and any write access to the home folder (fs:allow-home-write)

• T04: no CSP in an app that also has withGlobalTauri, a remote window, remote IPC, or shell, fs or http access

• T05: remote sites that can call commands (dangerousRemoteDomainIpcAccess, remote urls for any host, over http, or with shell, fs or http permissions)

• T06: an updater private key, a signCommand password or other secrets in the config

REVIEW (check before release)

• T11: a CSP that allows unsafe-eval, any source, whole schemes or remote script hosts

• T12: dangerousDisableAssetCspModification

• T13: withGlobalTauri: true

• T14: an updater without a usable public key, with http endpoints or dangerousInsecureTransportProtocol

• T15: programs allowed any arguments, whole user folders (Documents, Downloads, Desktop), and read access to the top of the home folder

• T16: HTTP scopes open to any host (https://**, https://*, *)

• T17: remote https sites with limited permissions

• T18: no CSP in an app without that access, such as the create-tauri-app default (tighten it before release)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (a Tauri 2 app with capabilities, a freshly scaffolded companion app and an older Tauri 1 app), and the real report the scanner produces on the risky one

Limits

It reads config and capability files as written. Rust code (custom commands, scopes added in tauri::Builder), app-defined permission files, a CSP set only in index.html, frontend code and the installed Tauri and plugin versions are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 21 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (13 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.