winui-code-review
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Secure Coding Guidelines]: The skill provides explicit guidance on security best practices for WinUI 3 development. This includes the use of
PasswordVaultfor secrets management,DataProtectionProviderfor encrypting data at rest, and rigorous input validation to prevent command injection and file system vulnerabilities. - [Indirect Prompt Injection Surface]: As a code review tool, the skill is designed to ingest and analyze external project files (XAML and C#). There is a theoretical consideration where malicious instructions embedded within the source code being reviewed (such as in code comments) could attempt to influence the agent's behavior. The skill mitigates this by providing structured checklists and specific diagnostic rules (WUIxxxx IDs) for the agent to follow, which helps maintain a focused analysis context.
- [Tooling and Dependencies]: The skill references official Microsoft Roslyn analyzers (
Microsoft.WindowsAppSDK.AnalyzersandMicrosoft.CodeAnalysis.NetAnalyzers). These are standard industry tools for static code analysis in the .NET and Windows development ecosystem. The description of the MSBuild environment hook (CustomAfterDirectoryBuildProps) is a technical explanation of how integrated development environment (IDE) tools automate analyzer injection during the build process.
Audit Metadata