Agent Skills › muratgur/ordinus › electron-secure-boundary

electron-secure-boundary

GitHub

维护Ordinus Electron应用的安全边界，确保特权桌面代码与UI代码分离。规范主进程、预加载和渲染器的职责，禁止渲染器直接访问敏感API，强制执行严格的安全配置及代码审查流程。

.codex/skills/electron-secure-boundary/SKILL.md muratgur/ordinus

Trigger Scenarios

修改BrowserWindow选项调整主进程/预加载/渲染器职责涉及特权系统访问或文件系统操作任何可能将Electron或Node能力暴露给渲染器代码的变更

Install

npx skills add muratgur/ordinus --skill electron-secure-boundary -g -y

More Options

Non-standard path

npx skills add https://github.com/muratgur/ordinus/tree/master/.codex/skills/electron-secure-boundary -g -y

Use without installing

npx skills use muratgur/ordinus@electron-secure-boundary

指定 Agent (Claude Code)

npx skills add muratgur/ordinus --skill electron-secure-boundary -a claude-code -g -y

安装 repo 全部 skill

npx skills add muratgur/ordinus --all -g -y

预览 repo 内 skill

npx skills add muratgur/ordinus --list

SKILL.md

Frontmatter

{
    "name": "electron-secure-boundary",
    "description": "Maintain Ordinus Electron security boundaries. Use when changing BrowserWindow options, main\/preload\/renderer responsibilities, privileged OS access, filesystem\/database\/process usage, or anything that could expose Electron or Node capabilities to renderer code."
}

Electron Secure Boundary

Objective

Keep Ordinus secure by preserving the separation between privileged desktop code and UI code.

Rules

Keep privileged work in Electron main process: filesystem, SQLite, child processes, provider runtimes, secrets, native dialogs, and OS integration.
Keep renderer as UI-only React code. Do not import or use Node APIs, Electron APIs, SQLite clients, filesystem modules, or child process modules in renderer.
Keep preload small and typed. Expose only purpose-built window.ordinus.* methods.
Never expose raw ipcRenderer, electron, filesystem, process, database, or generic command execution APIs to renderer.
Preserve nodeIntegration: false, contextIsolation: true, and sandbox: true unless the user explicitly asks for a security model redesign.
Avoid third-party runtime imports in preload. In sandboxed preload, prefer type-only imports plus ipcRenderer.invoke.

Workflow

Identify which side of the boundary the change touches: main, preload, renderer, or shared contracts.
Move privileged behavior to main process services or IPC handlers.
Add the narrowest preload method needed for renderer.
Keep validation and trust decisions in main/shared, not renderer.
Run npm run typecheck, npm run lint, and npm run build.
For boundary changes, smoke test npm run dev or the packaged app.

Red Flags

Renderer imports from electron, node:*, fs, path, child_process, better-sqlite3, or main-process modules.
Preload exposes general-purpose methods such as invoke(channel, payload) or runCommand(command).
IPC handlers trust renderer payloads without validation.
A UI feature requires relaxing sandbox settings before simpler IPC design has been tried.