winapp CLI is a command-line tool for Windows application development that manages SDKs, app identity, manifests, certificates, packaging, and build tools. It helps developers using frameworks such as .NET, Win32, CMake, Electron, or Rust access Windows-native development capabilities. The catalogue add-ons provide agent workflows for using the CLI.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add microsoft/winappCli --skill winui-code-reviewgit clone --depth 1 https://github.com/microsoft/winappCliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/winappcli/winui-code-review)<a href="https://agentmods.dev/skills/microsoft/winappcli/winui-code-review"><img src="https://agentmods.dev/badge/skills/microsoft/winappcli/winui-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/microsoft/winappcli/winui-code-review"><img src="https://agentmods.dev/badge/skills/microsoft/winappcli/winui-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.01578 |
| Opus 5.5 | $0.00028 | $0.00631 |
| Sonnet 5.5 | $0.00014 | $0.00316 |
| Haiku 4.5 | $0.00007 | $0.00158 |
Grade A, and why
winui-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to Use
Run a code review after the app builds and before committing. This catches quality issues that aren't build errors and aren't visible in UI tests — patterns that compile and run but are wrong, fragile, or slow.
How to Review
Read through the project's XAML and C# files and check each section below. For analyzer setup, see winui-dev-workflow; if it isn't installed, tell the user its checks didn't run.
Before reporting an API mismatch or recommending a replacement, verify it against the restored app project's references with CLI 0.7+ winapp find-api, for example winapp find-api members NavigationView --filter selected --json --project-dir <app-project-dir>. See winui-design for batch property checks and project selection; machine-SDK results are not proof of app-package availability.
The analyzer catches a curated set of WinUI 3 / Windows App SDK issues with categorized 4-digit IDs:
- WUI0xxx — UWP → WinUI 3 API compatibility (
UwpXamlNamespace,Window.Current,CoreDispatcher,GetForCurrentView) - WUI1xxx — Migration-table data-driven hints (UWP API has WinAppSDK equivalent, no equivalent, feature-area hint)
- WUI2xxx — Runtime / layout / XAML pitfalls (raw
TabViewcontent, nullable binding paths, ineffective binding modes, nullConverter, missingAutomationId, attached-property syntax) - WUI3xxx — MVVM patterns (old
[ObservableProperty]field syntax) - WUI4xxx — Interop (
WebView2not initialized, removed ONNX Runtime GenAI APIsWUI4101-WUI4103)
Use the installed package's diagnostic help links for rule details. Check inherited x:DefaultBindMode and event/command/converter exceptions before treating an omitted mode as a defect. Fix root causes; any justified false-positive suppression must be narrow and documented, not a blanket NoWarn policy. Keep IL/CsWinRT warnings enabled as well; the WinUI analyzer does not replace AOT/trim analysis.
MVVM Compliance
- ViewModels extend
ObservableObject, use[ObservableProperty]partial properties (not fields) - Commands use
[RelayCommand]attribute, not manualICommandimplementations - No UI types in ViewModels (
SolidColorBrush,Visibility,BitmapImage) — these belong in converters or XAML - No business logic in code-behind — only navigation, dialog coordination, and event wiring
-
async Taskfor async methods,async voidonly for event handlers - Never replace
ObservableCollection<T>— use.Clear()+ re-add
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +20 tokens per session 52d1c2545aa9
- 9d ago First seen · 95 lines · 49 tokens per session scan A 0613d60013cd
winui-code-review is a skill published in the GitHub repository microsoft/winappCli (1,314 stars, last pushed today), licensed MIT. It adds 69 tokens to every session and 1,578 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-07.
Other skills, from other repositories
find-simplifications
Use for a periodic repo-wide sweep of qwen-code for accumulated excess surface — dead components and files, orphaned locale keys, exports nothing consumes, added-then-removed scaffolding — filing candidates on a tracking issue and landing only what a maintainer has said yes to. Repo-wide and evidence-first; every…
swarm-pr-review
Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…
code-review
You are a senior code reviewer. You receive diffs via stdin.
include-test-files-that-assert-on-behavior-being-changed-in-decl
When delegating a task affected by this skill, include.
review
Adversarial fresh-context review and risk check of an increment before it ships; every finding cites path:line and is re-verified. Use for "review", "qa", "quality check", "critique this".
tech-debt-ci-review
Codex adapter for deep technical-debt and CI-stability audits. Use when asked to find test theater, flaky tests, missing or mis-scoped tests, brittle CI/toolchain behavior, structural debt blocking green PRs, or a remediation order for opencode-swarm.