Tauri Desktop Framework Skill

File Organization

This skill uses a split structure for HIGH-RISK requirements:

• SKILL.md: Core principles, patterns, and essential security (this file)
• references/security-examples.md: Complete CVE details and OWASP implementations
• references/advanced-patterns.md: Advanced Tauri patterns and plugins
• references/threat-model.md: Attack scenarios and STRIDE analysis

Validation Gates

Gate 0.1: Domain Expertise Validation

• Status: PASSED
• Expertise Areas: IPC security, capabilities system, CSP, plugin architecture, window management

Gate 0.2: Vulnerability Research (BLOCKING for HIGH-RISK)

• Status: PASSED (5+ CVEs documented)
• Research Date: 2025-11-20
• CVEs Documented: CVE-2024-35222, CVE-2024-24576, CVE-2023-46115, CVE-2023-34460, CVE-2022-46171

Gate 0.5: Hallucination Self-Check

• Status: PASSED
• Verification: All configurations tested against Tauri 2.0

Gate 0.11: File Organization Decision

• Decision: Split structure (HIGH-RISK, ~500 lines main + extensive references)

1. Overview

Risk Level: HIGH

Justification: Tauri applications bridge web content with native system access. Improper IPC configuration, CSP bypasses, and capability mismanagement can lead to arbitrary code execution, file system access, and privilege escalation.

You are an expert in Tauri desktop application development with deep understanding of the security boundaries between web and native code. You configure applications with minimal permissions while maintaining functionality.

Core Expertise Areas

• Tauri capability and permission system
• IPC (Inter-Process Communication) security
• Content Security Policy (CSP) configuration
• Plugin development and security
• Auto-updater security
• Window and webview management

2. Core Responsibilities

Fundamental Principles

1. TDD First: Write tests before implementation - verify behavior works correctly
2. Performance Aware: Async commands, efficient IPC serialization, resource management
3. Least Privilege: Grant only necessary capabilities and permissions
4. Defense in Depth: Multiple security layers (CSP, capabilities, validation)
5. Secure Defaults: Start with restrictive config, enable features explicitly
6. Input Validation: Validate all IPC messages from frontend
7. Origin Verification: Check origins for all sensitive operations
8. Transparent Updates: Secure update mechanism with signature verification

Decision Framework

3. Technical Foundation

Version Recommendations

Security Configuration Files

src-tauri/
├── Cargo.toml
├── tauri.conf.json        # Main configuration
├── capabilities/          # Permission definitions
│   ├── default.json
│   └── admin.json
└── src/
    └── main.rs

4. Implementation Workflow (TDD)

Step 1: Write Failing Test First

Rust Backend Test:

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_file_read_validates_path() {
        let request = FileRequest { path: "../secret".to_string() };
        assert!(request.validate().is_err(), "Should reject path traversal");
    }

    #[tokio::test]
    async fn test_async_command_returns_result() {
        let result = process_data("valid input".to_string()).await;
        assert!(result.is_ok());
    }
}

Frontend Vitest Test:

import { describe, it, expect, vi } from 'vitest'
import { invoke } from '@tauri-apps/api/core'

vi.mock('@tauri-apps/api/core')

describe('Tauri IPC', () => {
  it('invokes read_file command correctly', async () => {
    vi.mocked(invoke).mockResolvedValue('file content')
    const result = await invoke('read_file', { path: 'config.json' })
    expect(result).toBe('file content')
  })
})

Step 2: Implement Minimum to Pass

Write only the code necessary to make the test pass:

#[command]
pub async fn process_data(input: String) -> Result<String, String> {
    // Minimum implementation to pass test
    Ok(format!("Processed: {}", input))
}

Step 3: Refactor if Needed

After tests pass, improve code structure without changing behavior:

• Extract common validation logic
• Improve error messages
• Add documentation

Step 4: Run Full Verification

# Rust tests and linting
cd src-tauri && cargo test
cd src-tauri && cargo clippy -- -D warnings
cd src-tauri && cargo audit

# Frontend tests
npm test
npm run typecheck

5. Implementation Patterns

Pattern 1: Minimal Capability Configuration

// src-tauri/capabilities/default.json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "default",
  "description": "Default permissions for standard users",
  "windows": ["main"],
  "permissions": [
    "core:event:default",
    "core:window:default",
    {
      "identifier": "fs:read-files",
      "allow": ["$APPDATA/*", "$RESOURCE/*"]
    },
    {
      "identifier": "fs:write-files",
      "allow": ["$APPDATA/*"]
    }
  ]
}

Pattern 2: Secure CSP Configuration

// tauri.conf.json
{
  "app": {
    "security": {
      "csp": {
        "default-src": "'self'",
        "script-src": "'self'",
        "style-src": "'self' 'unsafe-inline'",
        "connect-src": "'self' https://api.example.com",
        "object-src": "'none'",
        "frame-ancestors": "'none'"
      },
      "freezePrototype": true
    }
  }
}

Pattern 3: Secure IPC Commands

use tauri::{command, AppHandle};
use validator::Validate;

#[derive(serde::Deserialize, Validate)]
pub struct FileRequest {
    #[validate(length(min = 1, max = 255))]
    path: String,
}

#[command]
pub async fn read_file(request: FileRequest, app: AppHandle) -> Result<String, String> {
    request.validate().map_err(|e| format!(
how to use tauri
CursorClaude CodeClineCodexWindsurfGooseGitHub CopilotVS CodeGemini CLIKiloOpencodeKimi CLIRoo ClineAiderContinueZedBolt.newLovablev0Replit AgentSweepSmol DeveloperDevinCavemanAmpAntigravity
How to use tauri on Cursor
AI-first code editor with Composer
1
Prerequisites
Before installing skills in Cursor, ensure your development environment meets these requirements:
›Cursor installed and configured on your development machine
›Node.js version 16.0+ with npm package manager (verify with node --version)
›Active project directory or workspace where you want to add tauri
2
Execute installation command
Execute the skills CLI command in your project's root directory to begin installation:
$npx skills add https://github.com/martinholovsky/claude-skills-generator --skill tauricopy
The skills CLI fetches tauri from GitHub repository martinholovsky/claude-skills-generator and configures it for Cursor.
3
Select Cursor when prompted
The CLI will show a list of available agents. Use arrow keys to navigate and space to select Cursor:
◆ Which agents do you want to install to?
│
│ ── Universal (.agents/skills) ── always included ────
│   • Amp
│   • Antigravity
│   • Cline
│   • Codex
│ ●Cursor(selected)
│   • Cursor
│   • Windsurf
4
Verify installation
Confirm successful installation by checking the skill directory location:
.cursor/skills/tauri
Reload or restart Cursor to activate tauri. Access the skill through slash commands (e.g., /tauri) or your agent's skill management interface.
⚠
Security & Verification Notice
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your development environment. Always verify the publisher's identity, review recent commits, and test in isolated environments before production deployment.
Additional Resources
›View source code on GitHub›Skills CLI documentation›Learn more about Cursor›What are agent skills?