Electron Dev

This is a solid reference for building production Electron apps with modern security defaults. It covers the full stack: IPC patterns with proper context isolation, system tray integration, global shortcuts, PTY terminal embedding with node-pty, and WebRTC voice chat patterns. The security section is especially useful since it clarifies that Electron 28+ ships with sandboxing enabled by default, then walks through ASAR integrity validation and common renderer exploits. Most Electron guides still cargo cult outdated advice, so the explicit callout about not needing to opt into contextIsolation anymore is refreshing. Use this when you're building desktop apps that need native system access without compromising the renderer process.

skills.sh installs: 315
GitHub stars: 451
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add jamditis/claude-skills-journalism --skill electron-dev --agent claude-code

Installs into .claude/skills of the current project.

Files

Electron desktop development

Patterns and practices for building production-quality Electron applications with React and TypeScript.

Security baseline (Electron 30+)

Electron's defaults have hardened over the past several releases. As of Electron 28+, contextIsolation: true and sandbox: true are the defaults for new BrowserWindow instances, most security advice from older guides assumed you had to opt in. You don't anymore; you have to opt OUT, and you should not.

Set explicitly anyway, so a config drift never weakens the security model:

const win = new BrowserWindow({
  webPreferences: {
    contextIsolation: true,        // default since 12, mandatory for any prod app
    sandbox: true,                  // default since 28; renderer runs sandboxed
    nodeIntegration: false,         // never enable in renderer
    webSecurity: true,              // never disable
    preload: path.join(__dirname, 'preload.cjs')
  }
});

Validate every IPC message in main. Don't trust the renderer.