Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/microsoft/win-dev-skills/winui-dev-workflownpx skills add microsoft/win-dev-skills --skill winui-dev-workflowgit clone --depth 1 https://github.com/microsoft/win-dev-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.01654 |
| Opus 5 | $0.00036 | $0.00827 |
| Sonnet 5 | $0.00015 | $0.00331 |
| Haiku 4.5 | $0.00007 | $0.00165 |
Grade A, and why
winui-dev-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create or Open a Project
New app — let WinApp CLI install/update the official templates and scaffold:
winapp new --name <AppName> --template winui-mvvm --template-version latest --use-defaults
cd <AppName>
Run winapp new --list to discover the currently installed template short names. Do not install the template pack separately and do not create the output directory first.
Existing app — read the .csproj to understand:
<TargetFramework>(e.g.,net10.0-windows10.0.26100.0)<PackageReference>versions (WindowsAppSDK, CommunityToolkit)- Project structure and established patterns
Install Packages
dotnet add package <Name>
Never specify --version — omitting it gets the latest stable and avoids outdated API mismatches.
Build & Run
WinApp CLI 0.6+ builds a .csproj and launches it directly:
winapp run . --debug-output
winapp run .\MyApp.csproj -c Release --arch arm64
For normal development, prefer the included BuildAndRun.ps1 wrapper. It invokes project-mode winapp run, injects the bundled Microsoft.WindowsAppSDK.Analyzers, and turns on --debug-output by default:
.\BuildAndRun.ps1
Invoke attached runs with mode: "async". The command stays attached while the app is open, so a synchronous call blocks for the app's lifetime. The output contains the running app's PID.
The wrapper only adds repository-specific analyzer and debug defaults. WinApp CLI handles:
- Project restore and build
- Configuration, architecture, runtime, and framework selection
- Packaged versus unpackaged detection
- Build-output and executable discovery
- Windows App Runtime setup
- Package registration and launch
Options and forwarded WinApp arguments:
.\BuildAndRun.ps1 # one top-level csproj; attached diagnostics
.\BuildAndRun.ps1 .\MyApp.csproj # explicit project
.\BuildAndRun.ps1 .\MyApp.csproj -c Release # forwarded to winapp run
.\BuildAndRun.ps1 .\MyApp.csproj --arch arm64 # forwarded to winapp run
.\BuildAndRun.ps1 . --detach --json # return after launch; emit PID as JSON
.\BuildAndRun.ps1 . --symbols # add Symbol Server-backed native symbols
.\BuildAndRun.ps1 --args "--flag value" # pass application arguments
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 112 lines · 73 tokens per session scan A 1539fce9d371
winui-dev-workflow is a skill published in the GitHub repository microsoft/win-dev-skills (406 stars, last pushed 6d ago), licensed MIT. It adds 73 tokens to every session and 1,654 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
technical-design-doc-creator
Creates comprehensive Technical Design Documents (TDD) with mandatory and optional sections through interactive discovery. Use when user asks to "write a design doc", "create a TDD", "technical spec", "architecture document", "RFC", "design proposal", or needs to document a technical decision before implementation. Do…
spec-driven-eval
Scores how completely an implementation fulfills a PRD/spec, case by case, and produces a single comparable final grade. Invoke only when explicitly named (e.g. run spec-driven-eval); do not auto-trigger. Use when benchmarking spec-driven implementations, grading acceptance criteria, evaluating whether a feature was…
content-to-pipeline
When the user wants to turn content into revenue, build a content-led GTM motion, reverse engineer distribution, or repurpose content across platforms. Also use when the user mentions 'content marketing,' 'content-led growth,' 'content to pipeline,' 'distribution,' 'content repurposing,' 'content strategy,' 'thought…
component-flattening-analysis
Detects misplaced classes and fixes component hierarchy problems — finds code that should belong inside a component but sits at the root level. Use when asking "clean up component structure", "find orphaned classes", "fix module hierarchy", "flatten nested components", or analyzing why namespaces have misplaced code.…
domain-identification-grouping
Groups existing components into logical business domains to plan service-based architecture. Use when asking "which components belong together?", "group these into services", "organize by domain", "component-to-domain mapping", or planning service extraction from an existing codebase. Do NOT use for identifying new…
frontend-blueprint
AI frontend specialist and design consultant that guides users through a structured discovery process before generating any code. Collects visual references, design tokens, typography, icons, layout preferences, and brand guidelines to ensure the final output matches the user's vision with high fidelity. Use when the…