Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/microsoft/win-dev-skills/winui-packagingnpx skills add microsoft/win-dev-skills --skill winui-packaginggit clone --depth 1 https://github.com/microsoft/win-dev-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00086 | $0.01381 |
| Opus 5 | $0.00043 | $0.00691 |
| Sonnet 5 | $0.00017 | $0.00276 |
| Haiku 4.5 | $0.00009 | $0.00138 |
Grade A, and why
winui-packaging scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Quick Reference
| Task | Command |
|---|---|
| Build for release | .\BuildAndRun.ps1 . -c Release --arch x64 --no-launch |
| Package + sign | winapp package <dir> --cert devcert.pfx |
| Generate + sign + package | winapp package <dir> --generate-cert --install-cert |
| Generate dev certificate | winapp cert generate |
| Trust certificate (admin) | winapp cert install ./devcert.pfx |
| Sign existing file | winapp sign ./app.msix ./devcert.pfx |
| Self-contained deployment | winapp package <dir> --cert devcert.pfx --self-contained |
End-to-End Workflow
Step 1: Build for Release
Build the project in Release configuration without launching it. Use the BuildAndRun.ps1 wrapper from the winui-dev-workflow skill — plain dotnet build does not load the bundled Microsoft.WindowsAppSDK.Analyzers, so release builds would ship without the analyzer gate that development builds get:
.\BuildAndRun.ps1 . -c Release --arch x64 --no-launch
--no-launch builds and registers a development package without starting the app. Run winapp unregister before installing the signed .msix in Step 5, so the development registration does not conflict with the packaged identity.
Step 2: Generate Certificate (one-time)
winapp cert generate --manifest .
Creates devcert.pfx (default password: password). The --manifest flag auto-matches the Publisher field in Package.appxmanifest.
Step 3: Trust Certificate (one-time, requires admin)
winapp cert install ./devcert.pfx
Adds cert to machine Trusted Root store. Persists across reboots.
Step 4: Package and Sign
winapp package <build-output-dir> --cert ./devcert.pfx
This locates appxmanifest.xml, stages the layout, generates resources.pri, creates .msix, and signs it.
Step 5: Install or Distribute
# Local install
Add-AppxPackage ./MyApp.msix
# Or double-click the .msix file
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 125 lines · 86 tokens per session scan A b0651e31f098
winui-packaging is a skill published in the GitHub repository microsoft/win-dev-skills (406 stars, last pushed 6d ago), licensed MIT. It adds 86 tokens to every session and 1,381 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
openyida-cross-platform-release-guard
OpenYida 跨端发布风险守卫。当改动涉及浏览器/URL 拉起（openyida login、bridge 页面唤起、resolveBrowserLauncher、openBrowser、spawn 打开浏览器）、或在 macOS 上开发但需要发布给 Windows/Linux 用户、或准备打 tag 发布新版本时使用。用于在发布前静态扫描并拦截「cmd /c start 截断 URL」「open -n 假装开新窗口」等只在非 macOS 端暴露的历史坑，并输出跨端人工验证清单。.
technical-design-doc-creator
Creates comprehensive Technical Design Documents (TDD) with mandatory and optional sections through interactive discovery. Use when user asks to "write a design doc", "create a TDD", "technical spec", "architecture document", "RFC", "design proposal", or needs to document a technical decision before implementation. Do…
spec-driven-eval
Scores how completely an implementation fulfills a PRD/spec, case by case, and produces a single comparable final grade. Invoke only when explicitly named (e.g. run spec-driven-eval); do not auto-trigger. Use when benchmarking spec-driven implementations, grading acceptance criteria, evaluating whether a feature was…
content-to-pipeline
When the user wants to turn content into revenue, build a content-led GTM motion, reverse engineer distribution, or repurpose content across platforms. Also use when the user mentions 'content marketing,' 'content-led growth,' 'content to pipeline,' 'distribution,' 'content repurposing,' 'content strategy,' 'thought…
component-flattening-analysis
Detects misplaced classes and fixes component hierarchy problems — finds code that should belong inside a component but sits at the root level. Use when asking "clean up component structure", "find orphaned classes", "fix module hierarchy", "flatten nested components", or analyzing why namespaces have misplaced code.…
domain-identification-grouping
Groups existing components into logical business domains to plan service-based architecture. Use when asking "which components belong together?", "group these into services", "organize by domain", "component-to-domain mapping", or planning service extraction from an existing codebase. Do NOT use for identifying new…