winapp-package

A workflow for packaging a Windows application as an MSIX installer, the standard package format used to install Windows apps.

In plain words
What is it for?
Use it to package GUI apps, command-line tools, services, and desktop applications built with technologies such as Electron, Flutter, .NET, Rust, C++, or Tauri.
Why use it?
It turns built application files into an installable package and can include signing for distribution or testing.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/microsoft/winappcli/winapp-package
Any agent
npx skills add microsoft/winappCli --skill winapp-package
Clone the repo
git clone --depth 1 https://github.com/microsoft/winappCli

Made for: Claude Code, Codex.

Per session 75 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,322 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00075 $0.02322
Opus 5 $0.00037 $0.01161
Sonnet 5 $0.00015 $0.00464
Haiku 4.5 $0.00007 $0.00232

Measured 2d ago against content hash fb60f7971313, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

winapp-package scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/winapp/skills/winapp-package/SKILL.md · 208 lines

How it starts

The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.

When to use

Use this skill when:

  • Creating an MSIX installer from a built app for distribution or testing
  • Packaging any Windows app — GUI apps, console apps, CLI tools, services, or background processes
  • Signing a package with a development or production certificate
  • Bundling the Windows App SDK runtime for self-contained deployment

Prerequisites

Before packaging, you need:

  1. Built app output in a folder (e.g., bin/Release/, dist/, build/)
  2. Package.appxmanifest — from winapp init or winapp manifest generate
  3. Certificate (optional) — devcert.pfx from winapp cert generate for signing

Usage

Basic packaging (unsigned)

# Package from build output — manifest auto-detected from current dir or input folder
winapp package ./bin/Release

# Specify manifest location explicitly
winapp package ./dist --manifest ./Package.appxmanifest

Package and sign in one step

# Sign with existing certificate
winapp package ./bin/Release --cert ./devcert.pfx

# Custom certificate password
winapp package ./bin/Release --cert ./devcert.pfx --cert-password MyP@ssw0rd

Generate certificate + package in one step

# Auto-generate cert, sign, and package
winapp package ./bin/Release --generate-cert

# Also install the cert to trust it on this machine (requires admin)
winapp package ./bin/Release --generate-cert --install-cert

Self-contained deployment

# Bundle Windows App SDK runtime so users don't need it installed (must have winappsdk reference in the winapp.yaml or *.csproj)
winapp package ./bin/Release --cert ./devcert.pfx --self-contained

Custom output path and name

# Specify output file
winapp package ./dist --output ./releases/myapp-v1.0.msix --cert ./devcert.pfx

# Custom package name
winapp package ./dist --name "MyApp_1.0.0_x64" --cert ./devcert.pfx

What the command does

  1. Locates Package.appxmanifest — looks in input folder, then current directory (or uses --manifest)
  2. Copies manifest + assets into a staging layout alongside your app files
  3. Discovers manifest-referenced files — any non-image file referenced in the manifest (e.g., AppExtension payloads like manifest.json, config files) is automatically copied from the manifest directory or input folder if missing from staging
  4. Generates resources.pri — Package Resource Index for UWP-style resource lookup (skip with --skip-pri)
  5. Runs makeappx pack — creates the .msix package file
  6. Signs the package (if --cert provided) — calls signtool with your certificate

Read the full file on GitHub · 208 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 208 lines · 75 tokens per session scan A fb60f7971313

Subscribe to this mod's changes

winapp-package is a skill published in the GitHub repository microsoft/winappCli (1,205 stars, last pushed 4d ago), licensed MIT. It adds 75 tokens to every session and 2,322 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

convert-mobile

Compress the Donahoe Method into mobile-first single-column layouts: thumb-zone CTA placement, Fitts-sized touch targets, mobile reading-pattern adaptation, sticky bottom CTA, and Method-density preservation under 375px width. Use when designing or rebuilding mobile rendering of a sales page, VSL page, lead-magnet…

FerroxLabs/wayland · 111 tokens

imagegen-frontend-mobile

Elite mobile app image-generation skill for creating premium, app-native screen concepts and flows. Designed for iOS, Android, and cross-platform mobile products. Prioritizes clean hierarchy, comfortably readable text, strong multi-screen consistency, controlled color palettes, non-generic creative direction, textured…

mediago-dev/mediago · 126 tokens

ideate

Generates exactly three distinct visual design options with independent layouts and interaction models, iterates on user feedback, and pins the confirmed option as the visual target.

agentlas-ai/agentlas-desktop · 34 tokens

url-to-code

Clones a live public website URL into a standalone, fully interactive frontend prototype by capturing its DOM, styles, assets, and responsive behaviors.

agentlas-ai/agentlas-desktop · 32 tokens

adapt

Adapt designs to work across different screen sizes, devices, contexts, or platforms. Implements breakpoints, fluid layouts, and touch targets. Use when the user mentions responsive design, mobile layouts, breakpoints, viewport adaptation, or cross-device compatibility.

paperboytm/spool · 51 tokens

apple-design

Cross-platform UI/UX design reviewer grounded in Apple Human Interface Guidelines principles. Use this skill to audit, review, critique, or improve any UI/UX design for mobile apps (iOS, Flutter, React Native) or desktop apps (macOS, Tauri, Electron). Triggers when the user mentions: design review, UI audit, HIG…

dickwu/apple-design-skill · 173 tokens