windows-msix-offline-installer
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The provided batch script includes a mechanism to request Administrator privileges by re-executing itself using the
RunAsverb. This is a standard requirement for modifying system-wide certificate stores and installing applications. - [COMMAND_EXECUTION]: The script uses the Windows
certutilutility to modify the system-wideTrustedPeoplecertificate store, which is necessary for the OS to trust a self-signed package. - [COMMAND_EXECUTION]: The installation process bypasses PowerShell execution policies using the
-ExecutionPolicy Bypassflag to facilitate the execution of theAdd-AppxPackagecommand. - [INDIRECT_PROMPT_INJECTION]: The installation script determines its target package by reading filenames from the local directory.
- Ingestion points: The target MSIX package path is determined by globbing (
app-*.msix) in the script's local directory (referenced in SKILL.md). - Boundary markers: None present; the script assumes any matching file in the distribution bundle is the legitimate package.
- Capability inventory: System-wide certificate modification via
certutiland application installation viaAdd-AppxPackage. - Sanitization: The script does not validate the specific version or integrity of the matched file before setting it as the installation target variable.
Audit Metadata