Workflow & Core Tools · JimLiu/baoyu-skills

baoyu-electron-extract

Name: baoyu-electron-extract
Author: JimLiu/baoyu-skills

Extracts resources and JavaScript from any installed Electron app (`.asar` bundle), restoring original sources from `.js.map` files when available or formatting minified code with Prettier otherwise. Use when user wants to "extract Electron app", "decompile Electron", "get the source code of <app>", "inspect app.asar", "看 Electron 应用源码", "提取 .asar", or asks how a desktop Electron app is built. Skips `node_modules` and supports both macOS and Windows.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

Unpacking is not implemented in-house; instead, it dynamically fetches the third-party package @electron/asar via npx at runtime to extract files. Arguments are passed as an array to spawn without shell string concatenation.

skills/baoyu-electron-extract/scripts/main.ts

const args = ["-y", "@electron/asar", "extract", asarPath, dest];

What is happening here: The single task of 'unpacking asar' is outsourced to the official ecosystem tool, while the skill only handles app discovery, directory organization, restoration, and reporting. The trade-off is that it downloads and executes unlocked third-party code from the npm registry at runtime (this directory has no package.json or lockfile).

Restoring the original source tree requires .js.map files to embed sourcesContent; if this condition is not met, it falls back to formatting minified code with Prettier—this defines the actual boundary of its claimed 'decompile' capability.

skills/baoyu-electron-extract/SKILL.md

only works when the `.js.map` embeds `sourcesContent`

The same section clarifies that this is a common scenario in modern bundlers (webpack/esbuild/Vite/rollup). Maps without embedded content are skipped and recorded in the warnings of extract-report.json. In other words, it restores embedded copies of source code included in build artifacts, rather than executing a decompilation algorithm.

JS/CSS files without usable source maps are batch-formatted in place using npx prettier --write to make minified code readable.

skills/baoyu-electron-extract/scripts/main.ts

const args = ["-y", "prettier", "--write", ...batch];

Executed in batches; non-zero exit codes only output warnings and proceed (`prettier batch exited with code ${code} (continuing)`), ensuring the main flow is not interrupted by formatting failures.

Cross-platform app discovery: macOS enumerates /Applications and ~/Applications, while Windows traverses roots such as LOCALAPPDATA and PROGRAMFILES; multiple matches trigger an error exit requiring the user to specify an absolute path.

skills/baoyu-electron-extract/scripts/main.ts

const roots = ["/Applications", join(homedir(), "Applications")];

SKILL.md explicitly states: `If discovery finds multiple matches, the script exits and lists them — re-run with an absolute path.`; platforms like Linux directly throw an error requiring --asar (`platform ${process.platform} is not auto-supported. Pass --asar /path/to/app.asar to override.`).

Hard disk-write guardrails: Refuses to write output to the root directory, directly to the user home, or to the current working directory; existing non-empty output directories require --force to write.

skills/baoyu-electron-extract/scripts/main.ts

const forbidden = [root, home, cwd];

SKILL.md states: `the script refuses to write to `/`, the user home directly, or the current working directory, and refuses to populate an existing non-empty output dir without `--force`.` Additionally, --dry-run only prints resolution results without disk writes.

node_modules and webpack/runtime noise are entirely skipped across unpacking statistics, source-map restoration, and Prettier formatting.

skills/baoyu-electron-extract/scripts/main.ts

return s.includes("node_modules/") || s.startsWith("webpack/runtime/");

SKILL.md defines this as a product principle: `**node_modules** is always skipped — both for source-map restoration and Prettier formatting — because vendored dependencies are noise when inspecting an app.`

The sources[] in the source-map determines disk write paths; the implementation first resolves against the map's directory and normalizes readable paths under restored/, falling back to hashes only when a path cannot be reduced to a safe path.

skills/baoyu-electron-extract/SKILL.md

Use `restored/__unknown/<hash>.<ext>` only when the source name is empty or cannot be reduced to a safe file path.

This is the only place in the skill handling 'untrusted input dictating paths'. SKILL.md specifies this in the 'Readable paths over hashes' section as 'resolve first, then sanitize'; in code, this corresponds to directory assembly and validation prior to writeFileSync(target, content).

Artifacts consist of a file tree and a machine-readable report: defaults to ~/Downloads/<AppName>-electron-extract/, containing extract-report.json (counts, warnings), with support for a single-line summary via --json.

skills/baoyu-electron-extract/scripts/main.ts

join(outputDir, "extract-report.json"),

SKILL.md output tree: `extract-report.json # JSON summary: counts, warnings, resolved paths`; when using --json, switches to single-line JSON output for easy direct count reading by agents.

2Core Capabilities

01Automatically locate app.asar by application name or absolute path (supports both macOS and Windows)

02Unpack asar (delegated to @electron/asar) and copy app.asar.unpacked/ alongside it

03Restore original source directory trees from sourcesContent (including sourceRoot resolution and bundler relative path normalization)

04Beautify minified JS/CSS in place using Prettier when maps are missing (can be disabled via --skip-format)

05Safe disk-writing policy: rejects hazardous destination paths, prevents overwriting non-empty directories (unless --force is used), and supports dry runs via --dry-run

06Structured artifacts and reporting: extracted/ + restored/ + extract-report.json (warnings enumerate skipped maps)

3External Dependencies

Kind	Dependency / Endpoint
cli	npx（Node 自带）/ bun
package	@electron/asar（运行时 npx 拉取，未锁版本）
package	prettier（运行时 npx 拉取，未锁版本）
cli	bun（首选运行时；无 bun 时由 npx -y bun 兜底）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Graded/per-use authorization, sandbox recommended

For Administrators

Approval workflow, rollback support, full audit

Evidence & Triggers (File Paths & Excerpts)

scripts/: Execute local script or command: bun {baseDir}/scripts/main.ts (or npx -y bun …) — invocation method specified in SKILL.md
网络端点: Declared external network access: registry.npmjs.org: on first run, npx -y fetches @electron/asar and prettier (no package.json in this directory)
本地工作目录: File I/O and artifact output: defaults to ~/Downloads/<AppName>-electron-extract/: extracted/, extracted.unpacked/, r

Audit Notes: Three-part self-verification: ① The evaluation subject is this skill directory (SKILL.md + scripts/main.ts + main.test.ts), not the host. ② Internal directory behavior = locally reads app.asar assets from installed Electron applications and writes to disk (output to ~/Downloads/…, with forbidden=[/, home, cwd] and --force guardrails); no user content leaves the network. The only outbound traffic is an expected package fetch from a fixed endpoint: skills/baoyu-electron-extract/SKILL.md states `**No global installs** — `@electron/asar` and `prettier` are resolved on-the-fly via `npx -y`.`, meaning it fetches two unpinned third-party packages from registry.npmjs.org and executes their code at runtime. ③ No credential reading, no exfiltration of user content, and no reverse engineering, spoofing, bypass, or security downgrades; hence no upgrade to Orange, much less Red. The supply chain consideration (fetching unpinned versions via npx) has been documented in verdict.risks.

5Second-Pass Verification

[ok] 解包委托 @electron/asar（非自研） — main.ts:404 逐字为 `const args = ["-y", "@electron/asar", "extract", asarPath, dest];`，spawn 以 argv 数组调用，无 shell 拼接。
[ok] npx 拉取未锁版本第三方包（供应链面） — 本目录无 package.json / lockfile，main.ts 内两处 npx 调用分别拉 @electron/asar 与 prettier；SKILL.md Notes 自述 'resolved on-the-fly via `npx -y`'，与代码一致。
[ok] source map 还原能力边界（需内嵌 sourcesContent） — SKILL.md 明写只在 `.js.map` 内嵌 sourcesContent 时可用，未内嵌则跳过并记 warnings；无夸大表述。
[ok] 写盘护栏（/、home、cwd 拒绝；非空目录需 --force） — main.ts assertSafeOutputDir 用 `const forbidden = [root, home, cwd];`；SKILL.md Safety 段文字与代码一致。
[ok] 平台支持范围（仅 macOS/Windows 自动发现） — main.ts:310-313 对非 darwin/win32 平台直接抛错要求 --asar；SKILL.md 同述，无夸大。
[ok] 外部依赖清单是否完整 — 全目录扫描 URL/API/凭证 token 零命中；唯二第三方包为 @electron/asar 与 prettier（均经 npx），运行时 bun/npx 为宿主运行时而非依赖。
[ok] 元数据（license/stars/commit） — git rev-parse HEAD=1567581c26ec29f4216c6e6835415bf30343b0e3；仓库根 LICENSE 首行 'MIT License'、'Copyright (c) 2026 Jim Liu'；GitHub API 返回 MIT / 25926 stars / 2026-09-10T15:13:43Z。
[discrepancy] 『decompile』措辞与实际能力是否相符 — 出题/触发词里的『decompile Electron』并不等于反编译：实际是解包 + 用构建产物自带的 source map 还原 + Prettier 美化（SKILL.md 自己写明前提是 sourcesContent 存在）。判级与结论不受影响，但详情页应写清这不是字节码/压缩代码的结构化反编译。

6Verdict & Scenarios

Turns inspecting Electron app internals into a single command: discovery, unpacking, restoration, formatting, and reporting are fully chained, defaulting output to Downloads rather than polluting the working directory.

Restoration prioritized over beautification: reconstructs original directory structures whenever sourcesContent is available (stripping webpack://, file://, ?loader, etc.), yielding far better results than pure formatting.

Safety guardrails built into code rather than just docs: rejects writing to /, home, or cwd; requires --force for non-empty directories; includes --dry-run preview.

Skips node_modules and webpack runtime to keep output focused on application-specific code; all skips and anomalies are surfaced in warnings rather than silenced.

Best for: Ideal for developers and security researchers who want to quickly inspect the internal structure (menus, updaters, embedded API endpoints, frontend assets) of a local desktop Electron application—especially when reviewing third-party client behavior, authoring Electron extensions, or studying project organization. Executable with a single command on macOS/Windows (e.g., bun scripts/main.ts Codex).

Not for: Not suitable for treating outputs as authoritative source code or for legal/compliance forensics (restoration relies on build artifact source maps; missing maps yield only Prettier-formatted minified code); not suitable for Linux environments lacking bun/Node or requiring zero-network downloads (first run requires fetching npx packages); not suitable for decompiling native binaries or bytecodes—this skill only handles JS, CSS, and assets inside asar.

Install Agent-Ready

① Verified Mirror 2026-09-15

Option A · Direct DownloadDownload baoyu-electron-extract.tar.gz

sha256: 3d2a2257d7155c7c…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit 1567581c26.