winui-setup

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • Privileged Command Execution: The skill utilizes Start-Process -Verb RunAs to enable Windows Developer Mode. This operation modifies a system-wide registry key in HKLM, which requires administrative elevation. The instructions explicitly state that the agent must ask for user confirmation before triggering the User Account Control (UAC) prompt.
  • External Software Installation: The skill automates the installation of dependencies using winget. It targets the .NET SDK and WinApp CLI packages. These packages (Microsoft.DotNet.SDK.10, Microsoft.WinAppCli) are official resources provided by the vendor, which aligns with standard setup procedures.
  • System Configuration Modification: The skill writes to the HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock registry path. While this is a standard method to enable Developer Mode for WinUI development, modifying the Local Machine registry is a sensitive operation.
  • Indirect Prompt Injection Surface: The skill ingests and parses data from the local environment by executing dotnet --list-sdks and winapp --version. This creates a surface where external tool output is processed to drive conditional logic (installation or upgrade decisions). The skill uses regex and version parsing to validate these inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 01:08 AM