rhwp-advanced
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to interact with the
rhwpRust CLI utility and uses thenpxcommand to retrieve and display dynamic instruction stubs. - [EXTERNAL_DOWNLOADS]: The skill instructions facilitate the download and installation of the
rhwpCLI tool from a public GitHub repository (viacargo install) and fetch configuration files from the vendor's GitHub-hosted repository. - [DYNAMIC_EXECUTION]: Operational instructions are retrieved dynamically at runtime using
npx -y @nomadamas/k-skill@0 instruct, which allows the agent to access up-to-date guidance hosted on the NPM registry. - [INDIRECT_PROMPT_INJECTION]: Because the skill processes external document formats (HWP/HWPX) for layout analysis and dumping, it possesses an ingestion surface where hidden instructions within a document could potentially attempt to influence agent output. However, the skill includes explicit warnings about masking sensitive data and requiring user approval for high-stakes actions.
Audit Metadata