winapp-find-api
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- Intent and Purpose: The skill is designed as an agent-first tool for API discovery and validation within the Windows/WinRT ecosystem. It facilitates grounding agent responses in actual metadata, which is a best practice for reliable code generation and diagnosing compilation errors.
- Local Resource Access: The tool accesses local project metadata, such as project.assets.json, .winmd, and .dll files, as well as the machine-wide Windows SDK. These are standard resources for development tooling and do not involve access to sensitive user credentials or private configuration files.
- Network Operations: The skill explicitly states that no network access is needed for performing queries. While prerequisites like project restoration (via dotnet restore) require network access, these are standard development workflows external to the skill's query execution.
- Indirect Prompt Injection Surface: The skill ingests and processes metadata from external project files. While this represents a theoretical injection surface if a user opens a malicious project, the tool's use of structured JSON output and its specific purpose as a diagnostic utility minimize this risk. The capability is aligned with the skill's primary function of API exploration.
- Trusted Vendor Context: The skill is authored by Microsoft and references established development tools and namespaces (e.g., WinUI 3, Windows App SDK). The documented patterns and CLI references are consistent with official vendor infrastructure.
Audit Metadata