hwp
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches its primary instructions and utility tools using
npx -y @nomadamas/k-skill@0.- [COMMAND_EXECUTION]: Provides bash commands to run thekordocCLI for document conversion, JSON extraction, and directory watching.- [DYNAMIC_EXECUTION]: Includes Node.js code blocks executed via heredocs (`node --input-type=module - <<'EOF'
) to demonstrate advanced document parsing, field extraction, and diffing via thekordoc` Node.js API.- [INDIRECT_PROMPT_INJECTION]: The skill parses external document files (HWP, HWPX, HWPML) which represents an attack surface for indirect instructions. - Ingestion points: Input files specified in
instruction.md(e.g.,보고서.hwp,검토서.hwpx). - Boundary markers: Not explicitly defined in the provided instructions.
- Capability inventory: Shell command execution via
kordocCLI and file system writing usingwriteFileSyncininstruction.md. - Sanitization: No specific sanitization or filtering of document content is described.
Audit Metadata