The Agent Skills Directory

[External Downloads]: The skill instructs the user to download the winapp CLI and SDK packages from official and well-known sources (Microsoft's Winget source, NPM, and NuGet). These are standard development practices involving trusted vendor resources.
[Command Execution]: Various commands are provided to scaffold new projects, build source code, and launch applications. These actions are necessary for the development workflow and are performed using official Microsoft tooling (dotnet, winapp).
[Indirect Prompt Injection Surface]: Because the skill reads and acts upon project files (like .csproj and nuget.config), it could theoretically be influenced by malicious content in a repository. However, the skill includes explicit security guidance, advising users to only run these tools on trusted codebases and recommending secure configuration practices like package source mapping.
[Credential Management]: The skill mentions the generation of a developer certificate (devcert.pfx) and correctly notes that it should be excluded from version control via .gitignore, following security best practices for handling sensitive development artifacts.

winapp-setup