Skills electron

📦

electron

Name: electron
Author: vercel-labs

Content revision r1 Critical ⚙️ External commands🌐 Network access

Automate Electron Apps with CDP

Electron apps are hard to inspect and test from an AI assistant. This skill connects agent-browser to CDP ports for snapshots, clicks, screenshots, and form actions.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "electron" from https://skillstore.io/skills/vercel-labs-electron.md and its manifest at https://skillstore.io/api/skills/vercel-labs-electron/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/vercel-labs-electron.md Signed manifest GET /api/skills/vercel-labs-electron/manifest Signed lockfile GET /api/skills/vercel-labs-electron/lockfile

Test it

Using "electron". Test navigation in a Slack-style Electron app.

Expected outcome:

A step-by-step automation trace with snapshot observations, selected element references, and screenshot file names.

Using "electron". Capture UI state for an Electron webview.

Expected outcome:

Connected to the selected CDP target.
Listed available pages and webviews.
Captured an annotated screenshot and summarized visible elements.

Using "electron". Extract visible text from a settings screen.

Expected outcome:

A concise summary of visible labels, controls, and values from the current screen.

Security Audit

Critical

v4 • 7/7/2026 Open versioned report

Most static Ruby backtick detections are markdown formatting or fixed command examples, but several command blocks intentionally expose and control Electron apps through CDP. The primary risk is sensitive desktop automation: the skill documents screenshots, text extraction, and app control while listing private communication tools and 1Password. The hardcoded URL findings are example output and not active network behavior.

Files scanned

237

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

SKILL.md:234

1Password data

- **Productivity:** Todoist, Linear, 1Password

The skill explicitly lists 1Password as a supported productivity app in an automation guide. Combined with screenshots and text extraction, this can expose credential-manager data.

Critical

SKILL.md:153-159 SKILL.md:230-234

Sensitive Application Automation Scope

The skill teaches CDP automation for desktop apps, then lists private communication tools and 1Password among supported apps. Snapshots, screenshots, and text extraction can expose private messages or credential-manager data.

The file directly combines data extraction commands with supported apps that include communication tools and 1Password. This is a clear sensitive-data exposure risk when used outside test accounts.

High

SKILL.md:19-24 SKILL.md:38-55 SKILL.md:77-85

Remote Debugging Port Exposure

The skill repeatedly instructs launching Electron apps with remote debugging enabled on predictable local ports. CDP access allows inspection and control of app UI while the port remains available.

The instructions explicitly enable CDP ports and connect automation tooling to them. Legitimate testing is possible, but the exposed interface is powerful and broad.

Capability review items (16)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:155-160

Ruby/shell backtick execution

```bash

This block extracts text and JSON snapshots from a connected desktop app. It can collect private UI data from applications under automation.

High

SKILL.md:224-236

Ruby/shell backtick execution

- Some Electron apps use custom input components; use `agent-browser keyboard inserttext "text"` to

This section recommends keyboard insertion and lists sensitive productivity apps including 1Password. It extends automation to apps where unintended input or access is sensitive.

Medium

SKILL.md:19-30

Ruby/shell backtick execution

```bash

This block launches Slack with a CDP debug port and then controls it through agent-browser. That can expose private app UI to automated snapshots and clicks.

Medium

SKILL.md:38-56

Ruby/shell backtick execution

```bash

This block launches named desktop apps with predictable CDP debug ports. Remote debugging exposes a local control interface for each app while it is running.

Medium

SKILL.md:60-64

Ruby/shell backtick execution

```bash

This block starts Linux Electron apps with remote-debugging ports. The commands intentionally expose CDP interfaces that can be controlled by agent-browser.

Medium

SKILL.md:68-71

Ruby/shell backtick execution

```bash

This block starts Windows Electron apps with remote-debugging ports. It creates local CDP endpoints for desktop app control and inspection.

Medium

SKILL.md:77-86

Ruby/shell backtick execution

```bash

This block connects agent-browser to a CDP port or auto-discovers a Chromium app. That gives the agent control over the connected desktop application.

Medium

SKILL.md:94-103

Ruby/shell backtick execution

```bash

This block switches among windows and webviews using agent-browser. It can select sensitive app surfaces once connected to a CDP port.

Medium

SKILL.md:109-126

Ruby/shell backtick execution

```bash

This block connects to an Electron app, switches to a webview, clicks elements, and screenshots it. That is intentional desktop UI automation through CDP.

Medium

SKILL.md:134-142

Ruby/shell backtick execution

```bash

This block launches Slack with a CDP port and automates navigation. Slack content can include private messages and workspace data.

Medium

SKILL.md:146-151

Ruby/shell backtick execution

```bash

This block captures screenshots of connected desktop apps. Screenshots can record private application state when used outside test accounts.

Medium

SKILL.md:164-171

Ruby/shell backtick execution

```bash

This block fills fields and presses keys in a connected app. Automated input can modify user data if used on real accounts.

Medium

SKILL.md:177-187

Ruby/shell backtick execution

```bash

This block connects separate sessions to Slack and VS Code. Multi-app control increases the scope of data and actions exposed to the agent.

Medium

SKILL.md:193-196

Ruby/shell backtick execution

```bash

This block connects to the active CDP port and takes a snapshot. The color-scheme setting is benign, but the command still inspects a desktop app.

Medium

SKILL.md:200-202

Ruby/shell backtick execution

```bash

This block connects agent-browser to a CDP port while setting a display option. The inspection target may still be a sensitive local app.

Medium

SKILL.md:223-224

Ruby/shell backtick execution

- Try `agent-browser keyboard type "text"` to type at the current focus without a selector

This line suggests typing into the current focus without a selector. That can affect the wrong field if the active focus is not verified first.

Detected Patterns

1Password data

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/vercel-labs-electron/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/vercel-labs-electron/security.svg)](https://skillstore.io/skills/vercel-labs-electron?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/vercel-labs-electron?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-electron/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/vercel-labs-electron.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

vercel-labs. (2026). electron security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vercel-labs-electron/audits/4

BibTeX citation

@techreport{vercel-labs-vercel-labs-electron-2026,
  author = {vercel-labs},
  title = {electron security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/vercel-labs-electron/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "electron security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "vercel-labs"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/vercel-labs-electron/audits/4"
identifiers:
  - type: other
    value: "skillstore:vercel-labs-electron:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Test Desktop UI Flows

Run repeatable snapshot, click, form, and screenshot checks against an Electron app during development.

Inspect Electron Webviews

Connect to app targets, switch into webviews, and review visible UI state for debugging.

Automate Local App Tasks

Control approved desktop apps through agent-browser sessions for controlled workflows and screenshots.

Try These Prompts

Connect to an App

Connect agent-browser to my Electron app on port 9222. Take an interactive snapshot and summarize the visible controls.

Capture Screenshots

Use the connected Electron app session to capture a normal screenshot and an annotated screenshot. Summarize what each image shows.

Test a Form Flow

Snapshot the app, find the search or input field, fill a test value, press Enter, and re-snapshot the result.

Inspect Multiple Targets

List all Electron targets, switch to the relevant webview, capture its UI state, and report the actions needed for a regression test.

Best Practices

Use dedicated test accounts and non-sensitive workspaces for automation.
Choose unique CDP ports and close the app after testing finishes.
Take a fresh snapshot after each navigation, click, or form submission.

Avoid

Do not connect to password managers, personal chat apps, or production accounts.
Do not leave remote debugging ports open after automation work ends.
Do not type into the current focus without confirming the active app and field.

Frequently Asked Questions

What apps can this skill automate?

It works with Electron and Chromium-based desktop apps that expose a CDP port.

Does the app need to be launched in a special way?

Yes. The app must start with remote debugging enabled before agent-browser can connect.

Can it control webviews inside Electron apps?

Yes. The skill explains how to list targets and switch into Electron webviews.

Can it take screenshots?

Yes. It supports normal, full-page, and annotated screenshots through agent-browser commands.

Is it safe for sensitive desktop apps?

Use caution. Avoid password managers, private chats, and production accounts because CDP can expose visible app data.

Which AI tools can use this skill?

The report lists support for Claude, Codex, and Claude Code.

Developer Details

Author

vercel-labs

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/vercel-labs/agent-browser/tree/main/skills/electron/

Ref

36e07d5e13068e5be64447e8f20b427cf2cbd21a

Maintenance freshness

7/18/2026

Usage

15 downloads · 107 views

File structure

📄 SKILL.md

electron

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (3)

Risk Factors

Detected Patterns

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Test Desktop UI Flows

Inspect Electron Webviews

Automate Local App Tasks

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details