wpf-rule-prohibitions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wpf-rule-prohibitions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Items explicitly banned from wpf-dev-pack. Do NOT introduce any of these during code generation, review, or refactoring.
For terminology used below (View First / ViewModel First Composition, Stateful / Stateless ViewModel), see docs/TERMINOLOGY.md.
Adopted combinations (per chosen MVVM framework):
(Mappings.xaml + implicit DataTemplate)
(RegisterForNavigation + IRegionManager.RequestNavigate)
ViewModelLocator.AutoWireViewModel is prohibitedProhibited:
<Window prism:ViewModelLocator.AutoWireViewModel="True" />Classification: View First Composition (an alternate mechanism inside Prism)
Reason: The Prism path's single matching mechanism is RegisterForNavigation + IRegionManager.RequestNavigate. ViewModelLocator locates and attaches the ViewModel by naming convention after the View is instantiated; using both mechanisms in the same Prism project produces two parallel matching paths, increasing maintenance and cognitive cost.
DataContext = new XxxViewModel() in View code-behind is prohibitedProhibited:
public XxxView()
{
InitializeComponent();
DataContext = new XxxViewModel(); // Prohibited
}Classification: View First Composition (imperative variant)
Reason: In the CommunityToolkit.Mvvm path the single matching mechanism is Mappings.xaml + implicit DataTemplate (ViewModel First). A View directly choosing its own VM breaks that single-path policy. In the Prism path the single mechanism is RegisterForNavigation; manual DataContext assignment likewise breaks single-path.
DataContext declaration is prohibitedProhibited:
<UserControl.DataContext>
<vm:XxxViewModel /> <!-- Prohibited -->
</UserControl.DataContext>Classification: View First Composition (declarative variant)
Reason: Same as P-001-b. Declarative specification of the VM type by the View is still the View choosing its own VM.
Prohibited: Adding any View-VM matching mechanism beyond the one selected for the chosen framework (e.g., naming-convention auto-matching, custom locators, reflection-based wiring).
Reason: Guarantees a single matching path per project. Co-existence of multiple mechanisms increases maintenance cost and cognitive load.
System.Windows.* UI types in ViewModel classes (except ICommand)Prohibited: References to System.Windows.* UI types (Visibility, Brush, ImageSource, Thickness, Window, etc.) from inside ViewModel classes.
Allowed exception: System.Windows.Input.ICommand (used by both RelayCommand and DelegateCommand).
Reason: Guarantees ViewModel testability and isolates the WPF framework dependency. Complies with the "view model is unaware of the view" principle from Microsoft's MVVM guidance. UI-type conversion belongs in the View layer (converters, triggers, value converters).
Prohibited: Registering all ViewModels as transient lifetime in the IoC container and delegating ViewModel state to an external Service/Manager.
Classification: Stateless ViewModel composition style (common in Stylet, Caliburn.Micro recommended patterns)
Reason: wpf-dev-pack adopts Stateful ViewModel as the standard state management style across both framework paths. Stateless-VM patterns belong to separate MVVM framework ecosystems and are outside this plugin's scope.
Prohibited: Within a single project, using both Mappings.xaml (CommunityToolkit path) and RegisterForNavigation + IRegionManager (Prism path) for View-VM wiring.
Reason: Each project picks one MVVM framework. The chosen framework selects exactly one matching mechanism. Mixing the two produces ambiguous View resolution and defeats the single-matching-path guarantee.
| Pattern | Classification | Policy |
|---|---|---|
Mappings.xaml implicit DataTemplate | ViewModel First (Stateful) | ✅ Adopted (CommunityToolkit path) |
Prism RegisterForNavigation + RequestNavigate("View") | View First (Stateful) | ✅ Adopted (Prism path) |
Prism ViewModelLocator.AutoWireViewModel | View First (Stateful) | ❌ Prohibited (P-001-a) |
code-behind DataContext = new VM() | View First (imperative) | ❌ Prohibited (P-001-b) |
Inline XAML <UserControl.DataContext> | View First (declarative) | ❌ Prohibited (P-001-c) |
| Naming-convention / reflection-based wiring | (any) | ❌ Prohibited (P-001-d) |
System.Windows.* in ViewModel (except ICommand) | — | ❌ Prohibited (P-002) |
| Stateless VM + transient IoC | Stateless VM | ❌ Prohibited (P-003) |
Mixing Mappings.xaml and Prism RegionManager | — | ❌ Prohibited (P-004) |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.