windows-msix-offline-installer

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The provided batch script includes a mechanism to request Administrator privileges by re-executing itself using the RunAs verb. This is a standard requirement for modifying system-wide certificate stores and installing applications.
  • [COMMAND_EXECUTION]: The script uses the Windows certutil utility to modify the system-wide TrustedPeople certificate store, which is necessary for the OS to trust a self-signed package.
  • [COMMAND_EXECUTION]: The installation process bypasses PowerShell execution policies using the -ExecutionPolicy Bypass flag to facilitate the execution of the Add-AppxPackage command.
  • [INDIRECT_PROMPT_INJECTION]: The installation script determines its target package by reading filenames from the local directory.
  • Ingestion points: The target MSIX package path is determined by globbing (app-*.msix) in the script's local directory (referenced in SKILL.md).
  • Boundary markers: None present; the script assumes any matching file in the distribution bundle is the legitimate package.
  • Capability inventory: System-wide certificate modification via certutil and application installation via Add-AppxPackage.
  • Sanitization: The script does not validate the specific version or integrity of the matched file before setting it as the installation target variable.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 07:03 AM
Security Audit — agent-trust-hub — windows-msix-offline-installer