With nodeIntegration on or ipcRenderer exposed to the page, one XSS in an Electron app becomes full control of your user's computer. This skill checks your app against the main points of Electron's own security checklist before you ship it, and tells you how to fix each finding.

Your agent runs a scanner on your main-process code, preload scripts, HTML pages and package.json. Comments are skipped. It reads webPreferences and command-line switches, what preload scripts expose through contextBridge, how URLs reach shell.openExternal, and, across the whole project, whether any code limits navigation and new windows and whether the pages have a Content Security Policy. It never runs Electron. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach.

What it checks

BLOCK (fix before shipping)

• E01: nodeIntegration on (also in workers, subframes and webview tags)

• E02: contextIsolation false

• E03: webSecurity false, allowRunningInsecureContent or disable-web-security

• E04: the whole ipcRenderer, any-channel forwarding or Node modules exposed through contextBridge

REVIEW (check before release)

• E11: renderer sandbox off (sandbox: false, --no-sandbox)

• E12: pages loaded over plain HTTP

• E13: no setWindowOpenHandler or will-navigate limit anywhere in the app

• E14: shell.openExternal with an unchecked URL

• E15: loaded pages with no Content Security Policy

• E16: Electron 41 or older in package.json

• E17: the remote module

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example app (main, preload, page, package.json), and the real report the scanner produces on the risky one

Limits

It reads code as text: settings built at run time, IPC handlers, permission handlers, Fuses and remote pages are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 14 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.