re-electron
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing several tools from official and well-known sources:
- Node.js packages: @electron/asar, chrome-remote-interface, bytenode, and @electron/fuses.
- System packages: nodejs, npm, binutils, and xvfb.
- Third-party tools: nvm, Ghidra, and IDA.
- [COMMAND_EXECUTION]: Provides instructions to execute various command-line tools for application analysis:
- Using npx to run Electron utility packages.
- Using curl to interact with the Chrome DevTools Protocol (CDP) endpoint.
- Using xvfb-run to execute GUI applications in a virtual framebuffer on Linux.
- [DYNAMIC_EXECUTION]: Describes methods for executing code within the context of a target application:
- Utilizing the Runtime.evaluate method via the Chrome DevTools Protocol.
- Running the target executable with the ELECTRON_RUN_AS_NODE environment variable to execute custom scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze external files from Electron applications, creating a potential surface for indirect prompt injection if the ingested data (e.g., extracted source code or metadata) contains malicious instructions.
- Ingestion points: resources/app.asar (archive extraction), .jsc files (V8 bytecode), and .node modules (native libraries) as described in SKILL.md.
- Boundary markers: No specific delimiters or warnings to ignore instructions embedded in the analyzed data are provided.
- Capability inventory: The skill utilizes file system operations (asar extract), network requests (curl), and shell command execution (npx, xvfb-run) across the documented workflows.
- Sanitization: No explicit sanitization or validation of the extracted application content is described.
Audit Metadata