hwpx-templates

Pass

Audited by Gen Agent Trust Hub on Apr 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script, scripts/fix_namespaces.py, using subprocess.run. This script is a maintenance utility that processes HWPX files (which are ZIP archives) to normalize XML namespace prefixes and remove stale tags, ensuring the generated documents open correctly in various viewers.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided HWPX templates. This establishes an attack surface for indirect prompt injection, where an attacker could embed malicious instructions within a template's XML structure or text runs. However, the skill's operations are focused on structural XML replacement rather than executing instructions from the document content, minimizing the risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 3, 2026, 12:22 PM