The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill provides instructions for the agent to read and process project-specific configuration files, which represents a potential attack surface if the files originate from untrusted sources. (1) Ingestion points: The skill describes processing metadata from .csproj, Package.appxmanifest, and package.json files within the workflows described in SKILL.md. (2) Boundary markers: There are no explicit instructions for using boundary markers or delimiters when interpreting the contents of these files. (3) Capability inventory: The skill uses shell execution capabilities for build and runtime operations, such as dotnet build, winapp run, and npm install. (4) Sanitization: The guidance does not include specific sanitization or validation steps for the content ingested from the project files.
[External Resource References]: The skill recommends installing dependencies from the @microsoft npm scope and the official Windows Package Manager (winget). It also links to documentation hosted on Microsoft's GitHub repositories. These are standard, vendor-provided resources and are considered safe for development use.
[Command Execution]: The skill guides the user through standard development commands for building and debugging applications. These operations are performed within the scope of the developer's project environment.

winapp-frameworks