hwpx-templates
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script,
scripts/fix_namespaces.py, usingsubprocess.run. This script is a maintenance utility that processes HWPX files (which are ZIP archives) to normalize XML namespace prefixes and remove stale tags, ensuring the generated documents open correctly in various viewers. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided HWPX templates. This establishes an attack surface for indirect prompt injection, where an attacker could embed malicious instructions within a template's XML structure or text runs. However, the skill's operations are focused on structural XML replacement rather than executing instructions from the document content, minimizing the risk.
Audit Metadata