hwp-template
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill is purely instructional and does not contain executable code, scripts, or binary files. It guides the agent to manage files within a specific 'templates/' subdirectory.
- [COMMAND_EXECUTION]: The skill defines logical file system operations (copying, deleting, and reading JSON metadata). These operations are restricted to the local project environment and include specific instructions for name validation (alphanumeric only) to mitigate injection risks.
- [DATA_EXFILTRATION]: No network requests, external data transfers, or access to sensitive system files (e.g., SSH keys, environment variables) are present in the instructions.
- [PROMPT_INJECTION]: The skill does not contain instructions to override system prompts, bypass safety filters, or ignore previous instructions.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external data (HWP files and metadata), it provides a manual validation rule for template names and limits its scope to local file management, minimizing the attack surface.
Audit Metadata