Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/microsoft/win-dev-skills/winui-setupnpx skills add microsoft/win-dev-skills --skill winui-setupgit clone --depth 1 https://github.com/microsoft/win-dev-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00088 | $0.01610 |
| Opus 5 | $0.00044 | $0.00805 |
| Sonnet 5 | $0.00018 | $0.00322 |
| Haiku 4.5 | $0.00009 | $0.00161 |
Grade A, and why
winui-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Install and verify the prerequisites every other winui-* skill assumes. WinApp CLI 0.6 owns WinUI template discovery and installation through winapp new; do not install the template pack separately.
[!IMPORTANT] Run this skill only when the user explicitly asks to set up or repair the toolchain. If it is loaded without an explicit request, do not run checks or installations; explain what the skill changes and wait for confirmation.
This skill is idempotent: detect everything first, install or upgrade only what is needed, and print one final summary.
Steps
Detect everything
Run these checks together so the user sees the full state before anything changes:
$minimumDotNet = [version]'8.0.100'
$minimumWinApp = [version]'0.6.0'
# .NET SDK — project-mode winapp run requires SDK 8.0.100+
$dotnetSdks = @(& dotnet --list-sdks 2>$null) | ForEach-Object {
$text = ($_ -replace ' \[.*$','').Trim()
$parsed = $null
if ([version]::TryParse(($text -split '-')[0], [ref]$parsed)) { $parsed }
}
$dotnetVersion = $dotnetSdks |
Where-Object { $_ -ge $minimumDotNet } |
Sort-Object -Descending |
Select-Object -First 1
$dotnetOk = $null -ne $dotnetVersion
# WinApp CLI — require 0.6+ for winapp new, find-ui, and project-mode run
$winappCmd = Get-Command winapp -ErrorAction SilentlyContinue
$winappVersion = $null
if ($winappCmd) {
foreach ($line in @(& winapp --version 2>$null)) {
$match = [regex]::Match(
[string]$line,
'^\s*v?(?<version>\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\s*$'
)
if ($match.Success) {
$parsed = $null
if ([version]::TryParse($match.Groups['version'].Value, [ref]$parsed)) {
$winappVersion = $parsed
}
}
}
}
$winappOk = $winappVersion -ge $minimumWinApp
# Developer Mode
$devModeOk = ((Get-ItemProperty `
-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock' `
-Name AllowDevelopmentWithoutDevLicense -ErrorAction SilentlyContinue
).AllowDevelopmentWithoutDevLicense) -eq 1
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 151 lines · 88 tokens per session scan A 061f5209c727
winui-setup is a skill published in the GitHub repository microsoft/win-dev-skills (406 stars, last pushed 6d ago), licensed MIT. It adds 88 tokens to every session and 1,610 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
technical-design-doc-creator
Creates comprehensive Technical Design Documents (TDD) with mandatory and optional sections through interactive discovery. Use when user asks to "write a design doc", "create a TDD", "technical spec", "architecture document", "RFC", "design proposal", or needs to document a technical decision before implementation. Do…
spec-driven-eval
Scores how completely an implementation fulfills a PRD/spec, case by case, and produces a single comparable final grade. Invoke only when explicitly named (e.g. run spec-driven-eval); do not auto-trigger. Use when benchmarking spec-driven implementations, grading acceptance criteria, evaluating whether a feature was…
content-to-pipeline
When the user wants to turn content into revenue, build a content-led GTM motion, reverse engineer distribution, or repurpose content across platforms. Also use when the user mentions 'content marketing,' 'content-led growth,' 'content to pipeline,' 'distribution,' 'content repurposing,' 'content strategy,' 'thought…
domain-identification-grouping
Groups existing components into logical business domains to plan service-based architecture. Use when asking "which components belong together?", "group these into services", "organize by domain", "component-to-domain mapping", or planning service extraction from an existing codebase. Do NOT use for identifying new…
frontend-blueprint
AI frontend specialist and design consultant that guides users through a structured discovery process before generating any code. Collects visual references, design tokens, typography, icons, layout preferences, and brand guidelines to ensure the final output matches the user's vision with high fidelity. Use when the…
cursor-subagent-creator
Creates Cursor-specific AI subagents with isolated context for complex multi-step workflows. Use when creating subagents for Cursor editor specifically, following Cursor's patterns and directories (.cursor/agents/). Triggers on "cursor subagent", "cursor agent". Do NOT use for generic subagent creation outside Cursor…