winui-design
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Resource Fetching: The winapp CLI tool downloads and caches UI sample data from external repositories like the WinUI Gallery and Community Toolkit. This is a functional requirement for providing up-to-date UI discovery and is conducted from established vendor sources.
- Command Execution: The skill instructions involve executing the winapp utility to search for and retrieve XAML/C# code snippets. This tool is a vendor-provided resource used for grounded sample discovery.
- Indirect Prompt Injection Surface: The agent processes output from the winapp tool, such as code samples and prerequisite notes. This introduces a surface where external content is ingested into the agent context; however, the risk is minimal as the content originates from curated Microsoft and community-managed galleries.
Audit Metadata