winui-design
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill instructs the agent to use a CLI tool named
winappfor discovering WinUI samples, layout patterns, and control usage. This tool is presented as a primary discovery mechanism for the developer workflow. - External Data Ingestion: Through the
winapptool, the skill fetches UI scenarios, XAML snippets, and C# code from remote sources including the WinUI Gallery and Windows Community Toolkit. These sources are established, trusted repositories within the Windows development ecosystem. - Indirect Prompt Injection Surface: The agent processes and incorporates content fetched from these external repositories. While this introduces an ingestion surface for untrusted data, the skill targets verified vendor and community resources, which serves as a significant mitigating factor.
- System API Interop: The provided implementation examples for window sizing utilize P/Invoke (
DllImport) to accessuser32.dllfor DPI scaling. This is a standard technical requirement for WinUI 3 applications to handle high-DPI displays correctly.
Audit Metadata