winapp CLI is a command-line tool for Windows application development that manages SDKs, app identity, manifests, certificates, packaging, and build tools. It helps developers using frameworks such as .NET, Win32, CMake, Electron, or Rust access Windows-native development capabilities. The catalogue add-ons provide agent workflows for using the CLI.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add microsoft/winappCli --skill winapp-sandboxgit clone --depth 1 https://github.com/microsoft/winappCliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/winappcli/winapp-sandbox)<a href="https://agentmods.dev/skills/microsoft/winappcli/winapp-sandbox"><img src="https://agentmods.dev/badge/skills/microsoft/winappcli/winapp-sandbox/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/microsoft/winappcli/winapp-sandbox"><img src="https://agentmods.dev/badge/skills/microsoft/winappcli/winapp-sandbox.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02004 |
| Opus 5.5 | $0.00025 | $0.00802 |
| Sonnet 5 | $0.00012 | $0.00401 |
| Haiku 4.5 | $0.00006 | $0.00200 |
Grade A, and why
winapp-sandbox scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 161 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Before acting
- Confirm the user wants Sandbox execution. Do not drop
--on sandboxto bypass an error. - Builds, project evaluation, and restore still run on the host. Do not build untrusted projects on the assumption that Sandbox isolates them.
- Windows supports one Sandbox; all apps inside it share a user, desktop, and state. Do not treat separate workflows as mutually isolated.
- Windows 11 24H2+ on a supported edition and hardware virtualization are required. Guest winapp supports x64/Arm64; x86 apps need guest support and matching dependencies.
- winapp only checks host prerequisites: it does not enable features, install the
client, request elevation, or reboot.
--on sandboxselects the target, not setup consent. - On
sandbox_setup_required, explain the required Windows feature and restart. Decide whether to offer agent-assisted setup or give the user manual steps; obtain explicit approval before running the suggested command in an elevated terminal. Use/NoRestartand let the user choose when to reboot:dism.exe /Online /Enable-Feature /FeatureName:Containers-DisposableClientVM /All /NoRestart. - On
sandbox_setup_requires_restart, ask the user to save work and restart when ready. Never restart automatically or treat setup approval as reboot approval. - On
sandbox_setup_incomplete, direct the user to open Windows Sandbox from Start and finish its client setup/update. Do not repeatedly retry an unchanged prerequisite. - Connection or reconnect may briefly take focus; do not promise zero desktop interruption.
- Existing Sandbox instances are reused and changed, not discarded. Never close one
or run
wsb stopwithout user consent.
Launch, inspect, act, verify
winapp run . --on sandbox --detach
winapp ui list-windows --on sandbox
winapp ui inspect --on sandbox -a MyApp
winapp ui invoke --on sandbox SubmitButton -a MyApp
winapp ui screenshot --on sandbox -a MyApp -o .\result.png
- Use
--detachwhen subsequent commands must inspect the running app; without it,runwaits for exit. Use--jsonwhen consuming the launch result programmatically. - Replace
MyAppwith the discovered name or copy the returnedUiTargetArgs. Keep--on sandboxon every guest UI command, including commands using a PID/HWND. - Inspect before acting and verify the result. Use
winapp-ui-automationfor selectors and input methods. Real input and recording need a connected, nonminimized client; read-only inspection can still work when input cannot. - Rebuild by rerunning the same command. Add
--cleanonly when clearing that app's data is intended.--debug-outputis supported only for packaged Sandbox apps. - Rediscover targets after the Sandbox is recreated. A detached unpackaged app can also end during guest-agent repair; rerun it if it disappears.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +3 lines 88e98ab4e87a
- yesterday Changed · +2 lines 1627fd768a96
- 6d ago First seen · 156 lines · 62 tokens per session scan A 31b4ef963f26
winapp-sandbox is a skill published in the GitHub repository microsoft/winappCli (1,268 stars, last pushed today), licensed MIT. It adds 62 tokens to every session and 2,004 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-17.
Other skills, from other repositories
dd-triage-flaky-test
Load when investigating a specific flaky test. Gets history, failure pattern, and category, then recommends fix, quarantine, or escalate.
dd-unblock-pr
Load when investigating a failing PR CI pipeline or checking PR health. Attributes each CI failure as flaky, infra, or regression, proposes a targeted action, and reports code coverage.
agent-inspect
Local evidence debugger and trajectory-test toolkit for TypeScript AI agents. Use when capturing framework-faithful traces, asserting TraceContract/TraceFacts, packaging Evidence v2, or inspecting local runs over read-only MCP (gettracefacts).
confirm-failures-are-causally-linked-to-the-task-before-reportin
When delegating a task affected by this skill, include.
isolate-the-specific-failure-mode-before-proposing-a-fix
When delegating a task affected by this skill, include.
issue-resolve
Use when an assessed gflow-cli issue (verdict CONFIRMED-BUG or LIKELY-BUG) has localized, verifiable scope and should be driven to a fix. Mutating and gated: it works in an isolated worktree, fixes test-first, and opens a DRAFT PR for human review. Built to run autonomously (hermes-ops) within a strict action envelope…