agentop: Skill for Claude Code

Security Best Practices

Security patterns and practices for building secure Electron applications with proper input validation, authentication, and defense against common vulnerabilities.

When to Use This Skill

• Implementing authentication/authorization
• Handling user input
• Managing secrets and API keys
• Processing external data
• Reviewing code for security issues
• Setting up Electron security

Core Security Principles

Defense in Depth

Layer multiple security controls:

// Layer 1: Input validation at entry point
function handleUserInput(input: string): void {
  const validated = validateInput(input);
  
  // Layer 2: Sanitization before processing
  const sanitized = sanitizeForProcessing(validated);
  
  // Layer 3: Parameterized queries (no string concatenation)
  await db.query('SELECT * FROM items WHERE name = ?', [sanitized]);
  
  // Layer 4: Output encoding for display
  const encoded = encodeForHTML(sanitized);
}

Principle of Least Privilege

Request only necessary permissions:

// ❌ Overly permissive
mainWindow = new BrowserWindow({
  webPreferences: {
    nodeIntegration: true,  // Dangerous!
    contextIsolation: false,  // Dangerous!
  }
});

// ✅ Minimal permissions
mainWindow = new BrowserWindow({
  webPreferences: {
    nodeIntegration: false,
    contextIsolation: true,
    sandbox: true,
    webSecurity: true,
    preload: path.join(__dirname, 'preload.js'),
  }
});

Electron Security

Secure Window Configuration

// src/main/window.ts
export function createSecureWindow(): BrowserWindow {
  const mainWindow = new BrowserWindow({
    width: 1200,
    height: 800,
    webPreferences: {
      // Security essentials
      nodeIntegration: false,
      contextIsolation: true,
      sandbox: true,
      webSecurity: true,
      allowRunningInsecureContent: false,
      
      // Preload for safe IPC
      preload: path.join(__dirname, 'preload.js'),
    },
  });
  
  // Prevent navigation to external URLs
  mainWindow.webContents.on('will-navigate', (event, url) => {
    const allowed = ['http://localhost:', 'file://'];
    if (!allowed.some(prefix => url.startsWith(prefix))) {
      event.preventDefault();
      console.warn('Blocked navigation to:', url);
    }
  });
  
  // Prevent new windows
  mainWindow.webContents.setWindowOpenHandler(({ url }) => {
    shell.openExternal(url);  // Open in system browser
    return { action: 'deny' };
  });
  
  return mainWindow;
}