The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates its various components using subprocess.run to call internal Python scripts and a vendored Node.js runtime (rhwp_convert.mjs). This is used for document assembly, namespace fixing, and HWP to HWPX conversion.
[PRIVILEGE_ESCALATION]: Automated conversion on Windows utilizes PowerShell with the -ExecutionPolicy Bypass flag to run the included convert_hwp_hancom.ps1 script. This is a common practice for enabling local automation scripts within a restricted environment.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes untrusted content from HTML and Markdown files.
Ingestion points: scripts/html2hwpx.py (HTML input), scripts/yoyak.py, and scripts/geomto.py (Markdown inputs).
Boundary markers: Absent; the tools interpret the structure of the provided data to build the document parts.
Capability inventory: The skill can execute local commands via subprocess.run and control the Hancom Office application via Windows COM automation (win32com.client.DispatchEx).
Sanitization: The skill employs xml_escape in scripts/hwpx_helpers.py to prevent XML injection, though it does not specifically filter for natural language instructions embedded in the input.

hwpx