Hwp Batch Convert Repo

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:20 AM UTC
• Version: 0.2.0

Overview

The skill is a real HWP batch converter, but its optional auto-approval feature can click security prompts using broad desktop-window matching.

Review before installing. Use this only for trusted HWP/HWPX files on a Windows machine with Hancom HWP installed. Avoid --auto-allow-dialogs for untrusted documents or shared desktop sessions because it may approve a matching security prompt without manual review. Prefer --plan-only first, choose a controlled output folder, and check JSON reports for any auto-dialog events.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hwp_batch_convert.py:333

Finding

Global Dialog Watcher Can Approve Spoofed or Unrelated Security Prompts

Content

View full analysis

Vulnerability Details

File Location: scripts/hwp_batch_convert.py, lines 333–363
Vulnerability Type: Improper authorization of UI automation targets
Risk Level: Medium

Vulnerable Code

python

def _scan_once(self) -> bool:
    matched = False
    hwnds: list[int] = []

    enum_proc = ctypes.WINFUNCTYPE(
        wintypes.BOOL,
        wintypes.HWND,
        wintypes.LPARAM,
    )(lambda hwnd, lparam: hwnds.append(hwnd) or True)
    USER32.EnumWindows(enum_proc, 0)

    for hwnd in hwnds:
        if hwnd in self._handled_hwnds or not USER32.IsWindowVisible(hwnd):
            continue
        title = USER32.GetWindowTextLengthW(hwnd)
        if title <= 0:
            continue
        window_title = ctypes.create_unicode_buffer(title + 1)
        USER32.GetWindowTextW(hwnd, window_title, title + 1)
        if window_title.value.strip() not in DIALOG_TITLE_WHITELIST:
            continue
        text_parts, allow_button_hwnd, allow_button_text = self._inspect_dialog(hwnd)
        window_text = ' '.join(part for part in text_parts if part).strip()
        reason = self._classify_candidate(
            window_title.value.strip(),
            window_text,
            allow_button_text,
        )
        if reason != 'match':
            if window_text:
                self._record_event(
                    AutoDialogEvent(
                        window_title=window_title.value.strip(),
                        window_text=window_text,
                        button_text=allow_button_text,
                        clicked=False,
                        reason=reason,
                    )
                )
                self._handled_hwnds.add(hwnd)
            continue
        clicked = False
        if allow_button_hwnd:
            USER32.SendMessageW(allow_button_hwnd, BM_CLICK, 0, 0)
            clicked = True

The application records newly created HWP process IDs in lines 403 and 429, but the dialog watcher does not use them:

py

...[truncated 2659 chars]

Remediation

View remediation

Remediation Suggestions

1. Use GetWindowThreadProcessId to retrieve the process ID of every candidate top-level window.
2. Pass the converter's verified process identity to AutoAllowDialogWatcher and reject any window whose owner is not in RealHwpConverter.owned_pids.
3. Verify the process image path and expected Hancom signature or installation path where feasible, rather than relying on the process name alone.
4. Fail closed when the HWP process cannot be uniquely identified. Do not enable automatic approval if process ownership cannot be established.
5. Bind eligible dialogs to the active conversion operation and, where possible, the specific document being opened.
6. Prefer a supported HWP automation security API or registered security module over generic desktop UI automation.
7. Require explicit user confirmation for ambiguous prompts or prompts belonging to pre-existing HWP processes.
8. Add negative tests that create matching dialogs from unrelated processes and verify that they are never clicked.
9. Update the documentation to clarify process-ownership guarantees and any remaining limitations of UI-based approval.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly documents an option to automatically click a security confirmation popup that grants document access, which normalizes bypassing an interactive security control. Even with a narrow whitelist, this increases the chance that sensitive document access is silently approved during automation and can undermine user awareness and consent around privileged document operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes operational capabilities that imply reading files, writing outputs, and invoking shell commands, but it does not declare any explicit tool scope or permission boundary. In an agent environment, this can cause the skill to run with broader ambient authority than reviewers or orchestrators expect, increasing the risk of unintended filesystem access, command execution, or unsafe use on attacker-influenced paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly describes auto-clicking a security confirmation dialog during HWP COM automation, which weakens a built-in user consent/security control. Even with a narrow whitelist, this can authorize document access or sensitive operations without an informed user decision, and the file does not prominently warn about the security tradeoff or require explicit opt-in acknowledgment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hwp_batch_convert.py (reported line 259)May include surrounding context.

python

def _snapshot_hwp_pids() -> set[int]:
    try:
        result = subprocess.run(['tasklist', '/FO', 'CSV', '/NH'], capture_output=True, text=True, encoding='utf-8', errors='ignore', check=False)
        if result.returncode != 0:
            return set()
        import csv

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The auto-dialog watcher is designed to detect Hancom security confirmation dialogs and automatically click allow buttons, which weakens a built-in security control meant to require user approval for sensitive document access. In a batch-conversion context handling untrusted HWP/HWPX files, this increases the chance that risky document actions proceed without operator review.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hwp_batch_convert.py (reported line 574)May include surrounding context.

python

[void]$form.ShowDialog()
""".strip()
    watcher = AutoAllowDialogWatcher(enabled=True, poll_interval=0.2)
    proc = subprocess.Popen(['powershell', '-NoProfile', '-STA', '-Command', dialog_script])
    try:
        clicked = watcher.click_once_for_test(timeout_seconds=timeout_seconds)
        proc.wait(timeout=timeout_seconds)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script exposes '--auto-allow-dialogs' as a normal runtime option without a strong user-facing warning, even though it automates approval of security-sensitive prompts. That creates a safety issue because users may enable it for convenience and unknowingly suppress an important trust boundary when converting potentially malicious documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README content is presented entirely in Korean, including usage guidance and warnings, with no indication that the skill is intentionally limited to Korean-speaking users or a Korea-specific compliance context. The policy requires avoiding forced language or locale constraints unless users are given a choice or the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The instructions hard-code Korean window titles and button/body text such as '한글', '접근하려는 시도', '모두 허용', and '허용'. This creates a language/locale constraint in the skill behavior, but the file does not state that the skill is Korean-only by design or offer any language/locale choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes local HWP batch conversion via COM automation, but this helper mode launches PowerShell and creates a Windows Forms dialog solely to test the auto-click handler. Spawning an additional scripting runtime and GUI test harness is a broader capability than the declared document-conversion purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

When --report-json is supplied, the code unconditionally writes to the specified path via write_text, which can overwrite an existing file. There is no confirmation prompt or runtime warning near the write operation to alert the user about this file-modifying behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.