The Agent Skills Directory

[External Downloads]: The skill references the acquisition of Windows build tools (such as makeappx) via the winapp update command and the use of the microsoft/setup-winapp GitHub Action. These downloads originate from the vendor's official infrastructure to support the application packaging workflow.
[Command Execution]: The instructions involve executing various shell commands and Windows utilities, including makeappx, signtool, and PowerShell cmdlets like Add-AppxPackage. These are standard tools for creating and installing Windows packages.
[Privilege Escalation]: Certain operations, such as installing certificates into the machine's trusted root store via winapp cert install, are noted to require administrative privileges. This is a standard requirement for modifying system-wide trust settings on Windows.
[Indirect Prompt Injection]: The skill describes a process that ingests external data—specifically build outputs and manifest files—to generate installers. While this presents a standard attack surface for packaging tools, the documentation encourages secure practices such as using repository secrets for sensitive credentials in CI/CD pipelines.

winapp-package