Claude Code, Plugin
Claw Hwp
AI(Claude·클로드 · Codex·코덱스)로 한글 문서(.hwp/.hwpx)를 한컴 없이 읽고·만들고·편집하는 오픈소스 스킬 · Read, create & edit Korean HWP in Claude/Codex
Compatibility: Portable across standard formats.
Grade D
Two or more Medium findings, or a High finding. Only try it in a sandbox.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 05cf0cb33513.
SECRETS_PATH_CREDENTIAL OBFUSCATION_ENCODED_BLOB
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
plugins/claw-hwp/skills/hwp/scripts/secure-fill.mjs, line 238
// "form pack" could copy an arbitrary file (e.g. ~/.ssh/id_rsa) into the - OBFUSCATION_ENCODED_BLOB Medium
Contains a long base64 shaped string in a file that should be readable.
plugins/claw-hwp/assets/icon.svg, line 1
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="512" height="512">
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach codeload.github.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
docs/preview-viewer.js, line 214
const res = await fetch(`/file?path=${encodeURIComponent(p)}`);
docs/preview-viewer.js, line 434
fetch("/__heartbeat", { method: "GET", cache: "no-store" }).catch(() => {});
plugins/claw-hwp/skills/hwp/scripts/preview-viewer.js, line 214
const res = await fetch(`/file?path=${encodeURIComponent(p)}`);
Show more
plugins/claw-hwp/skills/hwp/scripts/preview-viewer.js, line 434
fetch("/__heartbeat", { method: "GET", cache: "no-store" }).catch(() => {});
plugins/claw-hwp/skills/hwp/scripts/launcher/preview-linux.sh, line 33
curl -fsSL https://codeload.github.com/DoHyun468/claw-hwp/tar.gz/main \
plugins/claw-hwp/skills/hwp/scripts/create.js, line 90
// 2. The default init() path expects fetch(import.meta.url-relative);
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/claw-hwp/skills/hwp/scripts/secure-fill.mjs, line 238
// "form pack" could copy an arbitrary file (e.g. ~/.ssh/id_rsa) into the
.gitignore, line 12
.env
.gitignore, line 13
.env.local
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
plugins/claw-hwp/assets/icon.svg, line 1
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="512" height="512">
plugins/claw-hwp/skills/hwp/scripts/cell-patch.js, line 1
// cell-patch.js — Hancom-Docs-compatible in-place table cell editor.
plugins/claw-hwp/skills/hwp/scripts/create.js, line 1
#!/usr/bin/env node
Show more
plugins/claw-hwp/skills/hwp/scripts/hwpx-edit.js, line 1
#!/usr/bin/env node
plugins/claw-hwp/assets/icon.svg, line 9
" data-om-id="jsx:/https:/019e0222-cd41-7b4d-9069-7d4576f32690.claudeusercontent.com/v1/design/projects/019e0222-cd41-7b4d-9069-7d4576f32690/serve/icons-v15.jsx:1622:52:7"></feColo
plugins/claw-hwp/skills/hwp/scripts/cell-patch.js, line 2686
const PARALINE_SHAPE_HEX = '636572246365722400000000000000000000010018a600002c01000018a600002c01000000000b00000000000000000000000100000000000000f03f0000000000000000000000000000
plugins/claw-hwp/skills/hwp/scripts/cell-patch.js, line 4359
const IMG_PIC_COMP_HEX = '636970246369702400000000000000000000010070170000a60e000070170000a60e000000000b20000000000000000000000100000000000000f03f000000000000000000000000000000000
plugins/claw-hwp/skills/hwp/scripts/cell-patch.js, line 5663
const SHAPE_COMP_RECT_HEX = '6365722463657224000000000000000000000100983a00005e1a0000983a00005e1a000000000b00000000000000000000000100000000000000f03f0000000000000000000000000000000
plugins/claw-hwp/skills/hwp/scripts/cell-patch.js, line 5665
const SHAPE_LINE_COMP_HEX = '6e696c246e696c24000000000000000000000100983a00005e1a0000983a00005e1a000000000b00000000000000000000000100000000000000f03f0000000000000000000000000000000
plugins/claw-hwp/skills/hwp/scripts/cell-patch.js, line 6051
const TB_PREFIX_HEX = '4704e003206f736700406a14b42d00002c4c0000983a00005e1a0000000000000000000000000000537a9b42000000000800acc001ac15d6200085c7c8b2e4b22e004c08c00f63657224636572240
plugins/claw-hwp/skills/hwp/scripts/cell-patch.js, line 7901
const NUMBERING_TEMPLATE_HEX = '0c00000000003200ffffffff03005e0031002e000c01000000003200ffffffff03005e0032002e000c00000000003200ffffffff03005e00330029000c01000000003200ffffffff0300
plugins/claw-hwp/skills/hwp/scripts/references/chart-templates/chart-0.json, line 1
{"clusterHex":"42008001090000800008000000000000010000000000000000000000430420010b00206f736700000000000000000b000d004404800000000000000000004704e002206f736710220a140000000000000000f
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 05cf0cb33513. can reach a host that is not written as a fixed address. can reach codeload.github.com. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: 05cf0cb3351391a526cefb585f5886f9745226ec
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.