hwp-reader

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:01 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Korean HWP/HWPX document reader, with ordinary dependency and resource-limit cautions but no hidden, destructive, or data-stealing behavior found.

Install this only if you need Korean HWP/HWPX text extraction. Use a virtual environment, pin or review `pyhwp` before installing, and avoid feeding very large or untrusted HWPX files unless the runner has memory, CPU, and output limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–61 **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Dependencies - **pyhwp** (`pip install pyhwp`) — installed at `/Users/mupeng/Library/Python/3.9/lib/python/site-packages/hwp5/` - **Python 3.9+** — standard library `zipfile`, `xml.etree.ElementTree` ``` ### Technical Analysis The documented installation command resolves and installs the current version of `pyhwp` without a version constraint, package hash, lockfile, or trusted package-index restriction. Consequently, the dependency retrieved at installation time may differ from the version originally reviewed or tested. Python package installation can execute package build or installation logic. If the package, one of its transitive dependencies, or the configured package index is compromised, attacker-controlled code could run during installation. The absolute user-specific installation path also does not provide integrity assurance and may encourage reliance on an environment that has not been independently validated. This finding does not establish that `pyhwp` is malicious. The risk arises from mutable and unverified dependency resolution. ### Attack Path 1. An agent or user follows the documented `pip install pyhwp` instruction to enable HWP processing. 2. `pip` resolves the package and its transitive dependencies from the configured package index without enforcing reviewed versions or hashes. 3. An attacker compromises a relevant package release, dependency, maintainer account, or package source. 4. The malicious package is downloaded and installed. 5. Package installation logic executes with the privileges of the user running `pip`. 6. The installed code may execute again whenever the Skill processes a legacy HWP document. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the account p ...[truncated 456 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `pyhwp` and all transitive dependencies to versions that have been reviewed and tested. 2. Maintain a lockfile or requirements file containing cryptographic hashes, and install with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. 3. Explicitly use a trusted package index and prevent fallback to untrusted or unexpected indexes. 4. Install the dependency in an isolated virtual environment or container under a non-privileged account. 5. Scan pinned packages for known vulnerabilities and review updates before changing the lockfile. 6. Document the supported version rather than relying on a user-specific absolute installation path. 7. Where feasible, obtain prebuilt artifacts from a controlled internal repository after integrity and provenance verification. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30
• Finding: Unbounded Decompression and XML Parsing of Untrusted HWPX Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30–45 **Vulnerability Type**: Unbounded archive decompression and XML resource consumption **Risk Level**: Medium ### Vulnerable Code Snippet ```python python3 -c " import zipfile z = zipfile.ZipFile('FILE_PATH') # Quick preview text if 'Preview/PrvText.txt' in z.namelist(): print(z.read('Preview/PrvText.txt').decode('utf-8')) # Full content from section XMLs import xml.etree.ElementTree as ET for name in sorted(z.namelist()): if name.startswith('Contents/section') and name.endswith('.xml'): root = ET.fromstring(z.read(name)) for elem in root.iter(): if elem.text and elem.text.strip(): print(elem.text.strip()) " ``` ### Technical Analysis HWPX documents are ZIP archives containing XML and other resources. The example treats the input archive as trusted and reads matching entries completely into memory with `ZipFile.read()`. It does not limit: - The archive's compressed or expanded size. - The number of archive entries. - The expanded size of each entry. - The aggregate expanded size of processed entries. - Compression ratios. - XML document size, depth, element count, or parse time. - The quantity of text emitted to standard output. A crafted archive can therefore contain highly compressible entries with a small on-disk size but a very large expanded size. Each selected section is decompressed into a byte string and then parsed into an in-memory XML tree, increasing peak memory use. A large number of section files or deeply nested XML can also consume substantial CPU and memory. The snippet does not extract entries to filesystem paths, so ZIP path traversal is not demonstrated. The confirmed issue is resource exhaustion through unrestricted archive and XML processing. ### Attack Path 1. An attacker supplies a `.hwpx` document for reading or analysis. 2. The document is constructed with one or more `Contents/section*.xml` entries ...[truncated 1094 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject archives whose compressed size, declared expanded size, entry count, or aggregate expanded size exceeds documented limits. 2. Check each `ZipInfo.file_size`, `compress_size`, and compression ratio before reading an entry. Do not rely on metadata alone; enforce a limit while streaming decompressed data. 3. Replace unrestricted `ZipFile.read()` calls with bounded streaming reads and abort immediately when a per-entry or aggregate byte limit is exceeded. 4. Limit the number of `Contents/section*.xml` files processed and the maximum allowed preview size. 5. Parse XML with a hardened parser and enforce limits for document size, nesting depth, element count, text length, and processing time. 6. Process untrusted documents in a sandboxed, non-privileged worker with strict memory, CPU, execution-time, and output-size quotas. 7. Catch malformed archive, decompression, decoding, and XML parsing exceptions and fail closed with a controlled error. 8. Close archives deterministically by using `with zipfile.ZipFile(...) as z:`. 9. Add tests using oversized archives, high-compression-ratio entries, excessive entry counts, deeply nested XML, malformed XML, and excessive text output. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The 'When to Use' section includes broad triggers such as 'Any Korean document in Hangul Word Processor format,' which lacks specificity about context, intent, or exclusions. This can cause unintended invocation whenever a user mentions a .hwp/.hwpx file, rather than only when they explicitly want extraction or analysis.

Ssd 3

Low

• Confidence: 95% confidence
• Finding: The hardcoded absolute path reveals the author's local username and Python environment layout, which is unnecessary for skill operation and can leak host-specific information into prompts, logs, or downstream outputs. While low severity on its own, such details can aid environment fingerprinting and targeted social engineering or chaining with other weaknesses.

Static analysis

No suspicious patterns detected.