winmd-api-search
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [External Resource Integration]: The skill's cache generator project references the
Microsoft.WindowsAppSDKpackage from the official NuGet registry. This download is used to provide baseline API metadata for the search functionality and is a standard dependency for Windows development tools. - [Local Tool Build and Execution]: The
Update-WinMdCache.ps1script utilizes the.NET SDKto compile and run a local C# utility (CacheGenerator). This tool parses metadata from the local system and project files to create a searchable JSON index. This is an expected pattern for building high-performance developer tools. - [Metadata Processing Surface]: The skill ingests data from local project files (such as
.csprojandproject.assets.json) and Windows metadata files (.winmd) to populate its search results. While this represents a surface for indirect prompt injection, the skill processes this data as structured metadata rather than executable instructions, which reduces the potential impact.
Audit Metadata