HWP/HWPX/PDF extraction pipeline: attempt hwp-reader, then pyhwp, then OCR, with safe fallbacks. Use when agent needs reliable text extraction from Korean HW...

This skill appears to do exactly what it describes: extract text from local HWP/HWPX/PDF files and save JSON output. Before installing/use, consider: (1) it may execute a local 'hwp-reader' binary or a Python interpreter from ~/.openclaw/venv — ensure those binaries are trusted (an attacker controlling the working directory or venv could cause execution of malicious code); (2) it writes <id>_extracted.json into the current directory and creates a short-lived temp script when using pyhwp; (3) OCR is mentioned but not implemented in the script (system OCR tools are not invoked here). If you will run this on untrusted files or in multi-tenant environments, run it in an isolated container or sandbox and verify any helper binaries (hwp-reader, venv python) are from trusted sources.

Type: OpenClaw Skill Name: hwp-extract-pipeline Version: 1.0.0 The skill bundle provides a legitimate utility for extracting text from Korean HWP and HWPX documents using a multi-stage fallback pipeline (hwp-reader, pyhwp, and system strings). The core logic in `scripts/extract_hwp.py` uses safe subprocess execution and standard library functions for ZIP parsing and XML processing. While the script lacks sanitization for the `--id` parameter used in the output filename (a potential path traversal vulnerability), there is no evidence of malicious intent, data exfiltration, or unauthorized remote execution.