oma-hwp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can enter the LLM context indirectly because the skill converts the user-supplied HWP-family file (which may contain arbitrary outsider text) into Markdown via bunx kordoc@latest "{input_path}" -o "{output_path}", and then the agent reads that generated Markdown for in-conversation use; the post-processor resources/flatten-tables.ts only transforms/strips content and does not sanitize against prompt-injection text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's error-recovery and install guidance explicitly suggests running a remote installer that is fetched and executed at runtime (curl -fsSL https://bun.sh/install | bash), which downloads and runs remote code from https://bun.sh/install.