Agent Skills › muratgur/ordinus › electron-secure-boundary

electron-secure-boundary

GitHub

维护 Ordinus Electron 应用的安全边界，确保主进程处理特权操作，渲染器仅负责 UI。通过严格隔离、最小化 preload 暴露及禁用 Node 集成，防止敏感能力泄露至渲染层，保障应用安全架构。

.claude/skills/electron-secure-boundary/SKILL.md muratgur/ordinus

触发场景

修改 BrowserWindow 选项调整主进程/预加载/渲染器的职责划分涉及操作系统访问或文件系统操作任何可能将 Electron 或 Node 能力暴露给渲染代码的变更

安装

npx skills add muratgur/ordinus --skill electron-secure-boundary -g -y

更多选项

非标准路径

npx skills add https://github.com/muratgur/ordinus/tree/master/.claude/skills/electron-secure-boundary -g -y

不安装直接使用

npx skills use muratgur/ordinus@electron-secure-boundary

指定 Agent (Claude Code)

npx skills add muratgur/ordinus --skill electron-secure-boundary -a claude-code -g -y

安装 repo 全部 skill

npx skills add muratgur/ordinus --all -g -y

预览 repo 内 skill

npx skills add muratgur/ordinus --list

SKILL.md

Frontmatter

{
    "name": "electron-secure-boundary",
    "description": "Maintain Ordinus Electron security boundaries. Use when changing BrowserWindow options, main\/preload\/renderer responsibilities, privileged OS access, filesystem\/database\/process usage, or anything that could expose Electron or Node capabilities to renderer code."
}

Electron Secure Boundary

Objective

Keep Ordinus secure by preserving the separation between privileged desktop code and UI code.

Rules

Keep privileged work in Electron main process: filesystem, SQLite, child processes, provider runtimes, secrets, native dialogs, and OS integration.
Keep renderer as UI-only React code. Do not import or use Node APIs, Electron APIs, SQLite clients, filesystem modules, or child process modules in renderer.
Keep preload small and typed. Expose only purpose-built window.ordinus.* methods.
Never expose raw ipcRenderer, electron, filesystem, process, database, or generic command execution APIs to renderer.
Preserve nodeIntegration: false, contextIsolation: true, and sandbox: true unless the user explicitly asks for a security model redesign.
Avoid third-party runtime imports in preload. In sandboxed preload, prefer type-only imports plus ipcRenderer.invoke.

Workflow

Identify which side of the boundary the change touches: main, preload, renderer, or shared contracts.
Move privileged behavior to main process services or IPC handlers.
Add the narrowest preload method needed for renderer.
Keep validation and trust decisions in main/shared, not renderer.
Run npm run typecheck, npm run lint, and npm run build.
For boundary changes, smoke test npm run dev or the packaged app.

Red Flags

Renderer imports from electron, node:*, fs, path, child_process, better-sqlite3, or main-process modules.
Preload exposes general-purpose methods such as invoke(channel, payload) or runCommand(command).
IPC handlers trust renderer payloads without validation.
A UI feature requires relaxing sandbox settings before simpler IPC design has been tried.