hwp-reader

• Analyzed: May 11, 2026, 4:59 AM
• Findings: 1
• Version: 1.0.0
• Hash: 23b922389489bad73d37144c1b68e0dbea18bfffd25bdbf2a5381a921d0502c5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to read HWP/HWPX files, which is a legitimate purpose. However, the `SKILL.md` file contains `python3 -c "..."` commands that use a `FILE_PATH` placeholder. If the OpenClaw agent directly substitutes user-controlled input into this placeholder without proper sanitization, it could lead to shell injection vulnerabilities, allowing arbitrary command execution. Additionally, the HWPX parsing code uses `xml.etree.ElementTree`, which could be susceptible to XML-based denial-of-service attacks with specially crafted HWPX files. These are vulnerabilities that allow attacks, classifying the skill as suspicious rather than benign.