winapp-frameworks
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Package Installation: The skill instructs the agent to install
@microsoft/winappclivia npm andMicrosoft.winappclivia Winget. These packages originate from the vendor's official infrastructure and are used to provide the development tools described. - External Resource References: The skill contains numerous links to documentation and guides hosted on the vendor's official GitHub repository (
github.com/microsoft/WinAppCli). These links provide supplementary information for framework setup and packaging. - Command Execution: The instructions include several command-line examples for building, initializing, and running applications (e.g.,
dotnet build,winapp init,winapp run). These commands are standard for the developer workflows supported by this skill. - Indirect Prompt Injection Surface: The skill processes project-level configuration data from files such as
.csproj,package.json, andPackage.appxmanifest. While these files are integral to the build process, they represent a potential surface where untrusted content in a project could influence agent behavior. - Ingestion points: Project configuration files such as
.csproj,package.json, andPackage.appxmanifest(SKILL.md). - Boundary markers: No explicit boundary markers or "ignore" instructions for embedded data are defined.
- Capability inventory: The skill utilizes tool execution capabilities for building and running code across multiple development frameworks.
- Sanitization: No specific sanitization or validation of the input configuration files is mentioned in the prompt instructions.
Audit Metadata