winapp-package
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Administrative Privileges]: The skill documents commands that require administrative access, such as installing development certificates to the machine's trust store (
winapp cert install). This is a standard administrative requirement for enabling the local installation and testing of signed Windows packages. - [External Tool Acquisition]: The documentation indicates that certain components, such as the Microsoft Store Developer CLI and build tools like
makeappx, are downloaded by the utility when needed. These tools are provided by the vendor to facilitate the packaging and distribution process. - [Processing of Project Data]: The skill is designed to ingest and process project files (e.g.,
.csproj,.vcxproj), manifests, and build outputs to generate installers. This data ingestion is a core part of its packaging functionality, and users should ensure the source materials originate from trusted environments. - [Sensitive Parameter Handling]: The skill provides examples for handling certificate passwords during the signing process. While the examples use placeholder values, the documentation correctly illustrates the use of repository secrets in GitHub Actions to manage sensitive information securely in automated workflows.
Audit Metadata