Skills/npm/kordoc

kordoc@4.24.59

CAUTION· startup only

Publisher claims: "Parse Korean documents (HWP3-5, HWPX, HWPML, PDF, XLS(X), DOCX) to Markdown — CLI + MCP server with lossless patch/roundtrip, form-filler, document diff, print & layout-preserving SVG renderer" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher chrisryugj · publishing for 329 daysInstalls 236KLast detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso hancom.co.kr, huggingface.co, purl.org, idpf.org, gvisor.dev, openxmlformats.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- npx -y kordoc

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-10 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Hidden zero-width characters detected; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.2sprocessdependency install exit 0
28sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-dh2rTy/task/home/work/acme-api/.claude/skills/kordoc/dist/chunk-PXZVXAZY.js' } Node.js v22.23.4
28sprocessscript backend runs setup only
28sprocessno install scripts to re-run

Static findings

HIGH
Privileged sudo commanddist/chunk-7Y6KVNIT.js:10 · Privileged sudo command — agent may execute with elevated privileges…ootless runsc \uB294 \uB124\uD2B8\uC6CC\uD06C\uB97C \uB9C9\uC9C0 \uBABB\uD568). sudo \uB85C \uC2E4\uD589\uD558\uAC70\uB098 \uCEE8\uD14C\uC774\uB108 \uB7F0\uD0C0\uC78…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Hidden zero-width characters detecteddist/chunk-NMHCAYXY.js:76 · Hidden zero-width characters detected — may conceal contentraw = JSON.parse(text.replace(/^/, ""));Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Destructive file system command detecteddist/cli.js:1936 · Destructive file system command detectedif (!["png", "jpeg"].includes(fmt)) throw new KordocError(`--format \uC740 png|jpeg \uC911 \uD558\uB098: ${fmt}`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detecteddist/cli.js:463 · Destructive file system command detectedprocess.stderr.write(`[kordoc] --format \uB294 hwpx-preserve/hwpx/markdown \uC911 \uD558\uB098\uC5EC\uC57C \uD569\uB2C8\uB2E4: ${opts.format}Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detecteddist/cli.js:1870 · Destructive file system command detectedif (!["svg", "html", "png", "jpeg", "pdf"].includes(fmt)) throw new KordocError(`--format \uC740 svg|html|png|jpeg|pdf \uC911 \uD558\uB098: ${fmt}`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/chunk-7Y6KVNIT.js:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst r = spawnSync(runsc, args, { stdio: "inherit", env: { ...env, [INSIDE]: "1", KORDOC_OFFLINE: "1" } });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:25 · Unicode escape sequence detected — may contain obfuscated payloads"\uC81C\uC8FC\uD2B9\uBCC4\uC790\uCE58\uB3C4",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-APMUZQI7.js:57 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError(`HWPX \uC554\uD638\uD654 \uBC18\uBCF5 \uD69F\uC218\uAC00 \uD5C8\uC6A9 \uBC94\uC704\uB97C \uBC97\uC5B4\uB0AC\uC2B5\uB2C8\uB2E4: ${iterations}`);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-APMUZQI7.js:99 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-2ABMZKN4.cjs:272 · Unicode escape sequence detected — may contain obfuscated payloads…mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.` ); }…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-FPE6B6Y7.cjs:1190 · Unicode escape sequence detected — may contain obfuscated payloadsconst atOpen = prev === "" || /[\s(\[{<\u300c\u300e\u3010\u3008\u300a\u2018\u201c·,:]/.test(prev);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-FPE6B6Y7.cjs:968 · Unicode escape sequence detected — may contain obfuscated payloadsconst JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-APMUZQI7.js:26 · Unicode escape sequence detected — may contain obfuscated payloads… (\uBC30\uD3EC\uC6A9 \uBCF5\uD638\uB294 \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC74C). \uD55C\uCEF4\uC624\uD53C\uC2A4\uC5D0\uC11C \uC77C\uBC18 \uBB38\uC11C\uB85C \uC800\uC7A5\uD55C \uB4A4 \uC5EC\uC138\uC694." …Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Destructive file system command detecteddist/cli.js:1977 · Destructive file system command detectedif (!["png", "jpeg"].includes(cropFmt)) throw new KordocError(`--crop-format \uC740 png|jpeg: ${cropFmt}`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-DK6OHNBF.js:134 · npx invocation of non-well-known package — may execute untrusted code…NT = " \uB124\uD2B8\uC6CC\uD06C\uAC00 \uC81C\uD55C\uB41C linux/x64 \uC5D0\uC11C npx \uB85C \uC124\uCE58\uD588\uB2E4\uBA74 onnxruntime-node \uC758 CUDA \uB2E4\uC6B4\uB85C\…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/chunk-2NQ2U5WG.cjs:24 · Unicode escape sequence detected — may contain obfuscated payloadsreturn "\uBB38\uC11C \uCC98\uB9AC \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:14 · Unicode escape sequence detected — may contain obfuscated payloads"\uC138\uC885\uD2B9\uBCC4\uC790\uCE58\uC2DC",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-3AHL6YEA.js:18 · Unicode escape sequence detected — may contain obfuscated payloads"\uC8FC\uBBFC\uB4F1\uB85D\uBC88\uD638",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-JDHVJ5FT.js:811 · Unicode escape sequence detected — may contain obfuscated payloadsvar RING_SYLLABLE = "\uAC00\uB098\uB2E4\uB77C\uB9C8\uBC14\uC0AC\uC544\uC790\uCC28\uCE74\uD0C0\uD30C\uD558";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-FPE6B6Y7.cjs:1200 · Unicode escape sequence detected — may contain obfuscated payloadsreturn /^[\s.\u00b7\u2024\u2025\u2026\u2027\u2219\u22c5\u318d]+$/.test(text);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-FPE6B6Y7.cjs:811 · Unicode escape sequence detected — may contain obfuscated payloadsvar RING_SYLLABLE = "\uAC00\uB098\uB2E4\uB77C\uB9C8\uBC14\uC0AC\uC544\uC790\uCC28\uCE74\uD0C0\uD30C\uD558";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-JDHVJ5FT.js:810 · Unicode escape sequence detected — may contain obfuscated payloadsvar RING_JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-DK6OHNBF.js:27 · Unicode escape sequence detected — may contain obfuscated payloadsreturn "\uBB38\uC11C \uCC98\uB9AC \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-FPE6B6Y7.cjs:810 · Unicode escape sequence detected — may contain obfuscated payloadsvar RING_JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-5HUFJ72Q.js:1000 · Unicode escape sequence detected — may contain obfuscated payloadsvar HANGUL_SYLLABLE = "\uAC00\uB098\uB2E4\uB77C\uB9C8\uBC14\uC0AC\uC544\uC790\uCC28\uCE74\uD0C0\uD30C\uD558";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-5HUFJ72Q.js:1002 · Unicode escape sequence detected — may contain obfuscated payloadsvar IDEOGRAPH = "\u4E00\u4E8C\u4E09\u56DB\u4E94\u516D\u4E03\u516B\u4E5D\u5341";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Destructive file system command detecteddist/mcp.js:290 · Destructive file system command detected… \uC0C9\uC778\uC6A9, html_tables \uC640 \uD568\uAED8 \uBABB \uC500, CLI --table-format \uB300\uC751)'), script_tags: z.boolean().optional().describe('\uC704\xB7\u…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:20 · Unicode escape sequence detected — may contain obfuscated payloads"\uC804\uBD81\uD2B9\uBCC4\uC790\uCE58\uB3C4",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hidden zero-width characters detecteddist/cli.js:540 · Hidden zero-width characters detected — may conceal contentconst jsonContent = readFileSync2(jsonPath, "utf-8").replace(/^/, "");Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:16 · Unicode escape sequence detected — may contain obfuscated payloads"\uAC15\uC6D0\uD2B9\uBCC4\uC790\uCE58\uB3C4",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-5HUFJ72Q.js:3894 · Unicode escape sequence detected — may contain obfuscated payloads…table-split", "\uD398\uC774\uC9C0\uC5D0 \uAC78\uCE5C \uD45C \u2014 \uBD84\uD560 \uC9C0\uC624\uBA54\uD2B8\uB9AC\uAC00 \uC5C6\uC5B4 \uC2DC\uC791 \uD398\uC774\uC9C0 \uC601\uC5ED\uB9CC region \uC73C\u…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-3WSNLH4B.js:27 · Unicode escape sequence detected — may contain obfuscated payloads"\uC804\uB0A8\uAD11\uC8FC\uD1B5\uD569\uD2B9\uBCC4\uC2DC",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/chunk-2NQ2U5WG.cjs:124 · npx invocation of non-well-known package — may execute untrusted code…NT = " \uB124\uD2B8\uC6CC\uD06C\uAC00 \uC81C\uD55C\uB41C linux/x64 \uC5D0\uC11C npx \uB85C \uC124\uCE58\uD588\uB2E4\uBA74 onnxruntime-node \uC758 CUDA \uB2E4\uC6B4\uB85C\…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/chunk-5HUFJ72Q.js:1001 · Unicode escape sequence detected — may contain obfuscated payloadsvar HANGUL_JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Destructive file system command detecteddist/mcp.js:1114 · Destructive file system command detected…al().describe("\uACB0\uACFC \uC800\uC7A5 \uACBD\uB85C (\uD655\uC7A5\uC790\uB294 format \uACFC \uC77C\uCE58 \u2014 .png/.jpg/.svg/.html/.pdf). \uD398\uC774\uC9C0\uBCC4 \…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detecteddist/cli.js:2322 · Destructive file system command detectedprocess.stderr.write(`[kordoc] --table-format \uACFC --html-tables \uB294 \uD568\uAED8 \uC4F8 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Unicode escape sequence detecteddist/chunk-EN4MDTK5.js:7219 · Unicode escape sequence detected — may contain obfuscated payloadsvar KOREAN_LIST_SEQ = "\uAC00\uB098\uB2E4\uB77C\uB9C8\uBC14\uC0AC\uC544\uC790\uCC28\uCE74\uD0C0\uD30C\uD558";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-MYZZL77Z.js:1268 · Unicode escape sequence detected — may contain obfuscated payloadsvar JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-OT4LV5ME.js:272 · Unicode escape sequence detected — may contain obfuscated payloads…mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.` ); }…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-V75TUR6R.js:1558 · Unicode escape sequence detected — may contain obfuscated payloadsvar CIRCLED_JAMO = "\u3260\u3261\u3262\u3263\u3264\u3265\u3266\u3267\u3268\u3269\u326A\u326B\u326C\u326D";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-JDHVJ5FT.js:1190 · Unicode escape sequence detected — may contain obfuscated payloadsconst atOpen = prev === "" || /[\s(\[{<\u300c\u300e\u3010\u3008\u300a\u2018\u201c·,:]/.test(prev);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XKDFWNSS.js:12890 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError(`HWP3 \uC555\uCD95 \uD574\uC81C \uACB0\uACFC\uAC00 \uCD5C\uB300 \uD5C8\uC6A9 \uD06C\uAE30(${MAX_DECOMPRESS_SIZE2 / 1024 / 1024}MB)\uB97C \uCD08\uACFC\uD588\uC2B5\uB2C8\uB2E4`);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XKDFWNSS.js:12766 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-Q2VGRE5H.js:24 · Unicode escape sequence detected — may contain obfuscated payloadsreturn "\uBB38\uC11C \uCC98\uB9AC \uC911 \uC624\uB958\uAC00 \uBC1C\uC0DD\uD588\uC2B5\uB2C8\uB2E4";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-JDHVJ5FT.js:968 · Unicode escape sequence detected — may contain obfuscated payloadsconst JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-MYZZL77Z.js:2436 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-V75TUR6R.js:2766 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-WQYK6U2Y.js:287 · Unicode escape sequence detected — may contain obfuscated payloads…D\uC774 \uB4E0 \uBB38\uB2E8 \u2014 \uB3C4\uC7A5 \uAC00\uB85C \uC704\uCE58\uAC00 \uADFC\uC0AC\uAC12\uC785\uB2C8\uB2E4 (dx \uB85C \uBCF4\uC815)"); if (/<[A-Za-z0-9]+:(lineBreak|br)\b/.test(paraS…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-NLUKUB3X.js:501 · Unicode escape sequence detected — may contain obfuscated payloads…5C6\uC5B4 pages \uD544\uD130\uB97C \uC139\uC158 \uB2E8\uC704 \uADFC\uC0AC\uB85C \uC801\uC6A9\uD588\uC2B5\uB2C8\uB2E4" }); } } const blocks = allBlocks; applyPageText(blocks, shared); c…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-KFF47XZ7.js:252 · Unicode escape sequence detected — may contain obfuscated payloadsvar AMOUNT_DIGITS = "\uC601\uC77C\uC774\uC0BC\uC0AC\uC624\uC721\uCE60\uD314\uAD6C";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-V75TUR6R.js:1351 · Unicode escape sequence detected — may contain obfuscated payloads…CE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4."); let records; try { records = readRecords2(data2); } catch { t…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-MYZZL77Z.js:2501 · Unicode escape sequence detected — may contain obfuscated payloads…5C6\uC5B4 pages \uD544\uD130\uB97C \uC139\uC158 \uB2E8\uC704 \uADFC\uC0AC\uB85C \uC801\uC6A9\uD588\uC2B5\uB2C8\uB2E4" }); } let bodyBlocks = []; const doc = createHwp5DocState(); doc.keepT…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-V75TUR6R.js:2831 · Unicode escape sequence detected — may contain obfuscated payloads…5C6\uC5B4 pages \uD544\uD130\uB97C \uC139\uC158 \uB2E8\uC704 \uADFC\uC0AC\uB85C \uC801\uC6A9\uD588\uC2B5\uB2C8\uB2E4" }); } let bodyBlocks = []; const doc = createHwp5DocState(); doc.keepT…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-NLUKUB3X.js:2304 · Unicode escape sequence detected — may contain obfuscated payloads…k, orig, edited, ctx, skip); if (edited.kind === "html-table") return skip("\uBB38\uB2E8\u2192\uBCD1\uD569\uD45C(HTML) \uBCC0\uD658\uC740 \uBBF8\uC9C0\uC6D0 \u2014 GFM \uD45C(| \uD5E4\uB354 | …Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/chunk-Q2VGRE5H.js:124 · npx invocation of non-well-known package — may execute untrusted code…NT = " \uB124\uD2B8\uC6CC\uD06C\uAC00 \uC81C\uD55C\uB41C linux/x64 \uC5D0\uC11C npx \uB85C \uC124\uCE58\uD588\uB2E4\uBA74 onnxruntime-node \uC758 CUDA \uB2E4\uC6B4\uB85C\…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/chunk-UCGS2MCN.js:257 · Unicode escape sequence detected — may contain obfuscated payloads…mismatch: expected ${spec.sha256}, got ${actual} \u2014 \uBAA8\uB378 URL \uC774 \uC624\uC5FC\uB418\uC5C8\uAC70\uB098 \uC804\uC1A1 \uC911 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.` ); }…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XIFN4NSV.js:10239 · Unicode escape sequence detected — may contain obfuscated payloads"\uD55C\uCEF4\uC0B0\uB73B\uB3CB\uC6C0": PDF_\uD55C\uCEF4\uC0B0\uB73B\uB3CB\uC6C0,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-MYZZL77Z.js:1269 · Unicode escape sequence detected — may contain obfuscated payloadsvar CIRCLED_JAMO = "\u3260\u3261\u3262\u3263\u3264\u3265\u3266\u3267\u3268\u3269\u326A\u326B\u326C\u326D";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-V75TUR6R.js:1557 · Unicode escape sequence detected — may contain obfuscated payloadsvar JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XIFN4NSV.js:10257 · Unicode escape sequence detected — may contain obfuscated payloads"\uACBD\uAE30\uCC9C\uB144\uBC14\uD0D5 Regular": PDF_\uACBD\uAE30\uCC9C\uB144\uBC14\uD0D5_Regular,Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XIFN4NSV.js:8472 · Unicode escape sequence detected — may contain obfuscated payloadsvar PDF_\uACBD\uAE30\uCC9C\uB144\uBC14\uD0D5_Regular = {Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-MYZZL77Z.js:1062 · Unicode escape sequence detected — may contain obfuscated payloads…CE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4."); let records; try { records = readRecords2(data); } catch { th…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XKDFWNSS.js:12763 · Unicode escape sequence detected — may contain obfuscated payloads…B300 \uD5C8\uC6A9 \uD06C\uAE30(${MAX_DECOMPRESSED_BYTES / 1024 / 1024}MB)\uB97C \uCD08\uACFC\uD588\uC2B5\uB2C8\uB2E4` ); } throw new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XKDFWNSS.js:12769 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError("\uBE44\uBC00\uBC88\uD638\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4.");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XIFN4NSV.js:7831 · Unicode escape sequence detected — may contain obfuscated payloadsvar PDF_\uD55C\uCEF4\uC0B0\uB73B\uB3CB\uC6C0 = {Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XKDFWNSS.js:12425 · Unicode escape sequence detected — may contain obfuscated payloadsif (ch >= 14272 && ch <= 14277) return "\uD55C\uAE00\uACFC\uCEF4\uD4E8\uD130".codePointAt(ch - 14272);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-JDHVJ5FT.js:1200 · Unicode escape sequence detected — may contain obfuscated payloadsreturn /^[\s.\u00b7\u2024\u2025\u2026\u2027\u2219\u22c5\u318d]+$/.test(text);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XQ5NDWB3.cjs:1354 · Unicode escape sequence detected — may contain obfuscated payloads…CE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4."); let records; try { records = readRecords2(data2); } catch (e6) { …Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XQ5NDWB3.cjs:1561 · Unicode escape sequence detected — may contain obfuscated payloadsvar CIRCLED_JAMO = "\u3260\u3261\u3262\u3263\u3264\u3265\u3266\u3267\u3268\u3269\u326A\u326B\u326C\u326D";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XQ5NDWB3.cjs:2769 · Unicode escape sequence detected — may contain obfuscated payloads…CE58\uD558\uC9C0 \uC54A\uAC70\uB098 \uC554\uD638\uD654 \uB370\uC774\uD130\uAC00 \uC190\uC0C1\uB418\uC5C8\uC2B5\uB2C8\uB2E4."); } assertDecryptedDocInfo(docInfoData, readRecords); } return { …Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XQ5NDWB3.cjs:2834 · Unicode escape sequence detected — may contain obfuscated payloads…5C6\uC5B4 pages \uD544\uD130\uB97C \uC139\uC158 \uB2E8\uC704 \uADFC\uC0AC\uB85C \uC801\uC6A9\uD588\uC2B5\uB2C8\uB2E4" }); } let bodyBlocks = []; const doc = createHwp5DocState(); doc.keepT…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-XQ5NDWB3.cjs:1560 · Unicode escape sequence detected — may contain obfuscated payloadsvar JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/mcp.js:138 · Unicode escape sequence detected — may contain obfuscated payloadsif (!filePath) throw new KordocError("\uD30C\uC77C \uACBD\uB85C\uAC00 \uBE44\uC5B4\uC788\uC2B5\uB2C8\uB2E4");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/cli.js:454 · Unicode escape sequence detected — may contain obfuscated payloads…ON (\uB77C\uBCA8\u2192\uD3EC\uB9F7) \u2014 \uC608: '{"\uB0A0\uC9DC":"yy.mm.dd","\uC8FC\uBBFC\uB4F1\uB85D\uBC88\uD638":"rrn:masked"}'`).option("--template <name>", "\uB0B4\uC7A5 \uD45C\uC900 \uC11C…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/mcp.js:214 · Unicode escape sequence detected — may contain obfuscated payloadsEISDIR: "\uD30C\uC77C\uC774 \uC544\uB2C8\uB77C \uB514\uB809\uD1A0\uB9AC\uC785\uB2C8\uB2E4",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/cli.js:731 · Unicode escape sequence detected — may contain obfuscated payloadsprocess.stderr.write(`[kordoc] ${flag} \uAC12\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4: ${raw}${allowNeg ? "" : " (0 \uC774\uC0C1 \uC22B\uC790)"}Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-YOAAZRJP.js:971 · Unicode escape sequence detected — may contain obfuscated payloadsconst JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:1294 · File type combined with upload action — agent may exfiltrate local data files…: "\uACAC\uBCF8"}:${basename5(tplPath)}) \u2192 ${outPath2} `); if (opts.json) process.stdout.write(JSON.stringify({ output: outPath2, preset: null, ...opts.pack ? { pack: tplPath, packKind: opts.packKin…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/cli.js:558 · Unicode escape sequence detected — may contain obfuscated payloadsprocess.stderr.write(`[kordoc] \uCC44\uC6B8 \uD544\uB4DC\uB97C \uC9C0\uC815\uD574\uC8FC\uC138\uC694 (-f \uB610\uB294 -j \uC635\uC158)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-ZMBSNNH2.js:302 · Unicode escape sequence detected — may contain obfuscated payloadsvar AMOUNT_DIGITS = "\uC601\uC77C\uC774\uC0BC\uC0AC\uC624\uC721\uCE60\uD314\uAD6C";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-YOAAZRJP.js:814 · Unicode escape sequence detected — may contain obfuscated payloadsvar RING_SYLLABLE = "\uAC00\uB098\uB2E4\uB77C\uB9C8\uBC14\uC0AC\uC544\uC790\uCC28\uCE74\uD0C0\uD30C\uD558";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-YO3DF4UK.cjs:302 · Unicode escape sequence detected — may contain obfuscated payloadsvar AMOUNT_DIGITS = "\uC601\uC77C\uC774\uC0BC\uC0AC\uC624\uC721\uCE60\uD314\uAD6C";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:1522 · File type combined with upload action — agent may exfiltrate local data files…file\uB85C \uC7AC\uD604) \u2014 kordoc profile \uCC38\uC870.hwpx -o \uC11C\uC2DD.json").option("-o, --output <path>", "\uCD9C\uB825 JSON \uACBD\uB85C (\uAE30\uBCF8: <\uC785\uB825>.profile.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-YOAAZRJP.js:1203 · Unicode escape sequence detected — may contain obfuscated payloadsreturn /^[\s.\u00b7\u2024\u2025\u2026\u2027\u2219\u22c5\u318d]+$/.test(text);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:1829 · File type combined with upload action — agent may exfiltrate local data filesif (opts.json) process.stdout.write(JSON.stringify({ output: out, manifest }, null, 2) + "\n");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.d.ts:3027 · File type combined with upload action — agent may exfiltrate local data files* console.log(result.output) // 채워진 마크다운Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-YOAAZRJP.js:1193 · Unicode escape sequence detected — may contain obfuscated payloadsconst atOpen = prev === "" || /[\s(\[{<\u300c\u300e\u3010\u3008\u300a\u2018\u201c·,:]/.test(prev);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/cli.js:499 · Unicode escape sequence detected — may contain obfuscated payloadsprocess.stderr.write(`[kordoc] \uC11C\uC2DD \uD30C\uC77C \uACBD\uB85C \uB610\uB294 --template \uC744 \uC9C0\uC815\uD574\uC8FC\uC138\uC694 (\uBAA9\uB85D: kordoc fill --list-templates)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/setup-U5XWE7T7.js:173 · Unicode escape sequence detected — may contain obfuscated payloadsconsole.log(` ${c.dim}\uD074\uB77C\uC774\uC5B8\uD2B8\uB97C \uC7AC\uC2DC\uC791\uD558\uBA74 'kordoc' MCP \uC11C\uBC84\uAC00 \uD65C\uC131\uD654\uB429\uB2C8\uB2E4.${c.reset}`);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:1006 · File type combined with upload action — agent may exfiltrate local data filesif (!opts.json) process.stderr.write(`[kordoc] \uC624\uB958: ${input}: ${sanitizeError(err)}Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/mcp.js:159 · Unicode escape sequence detected — may contain obfuscated payloadsthrow new KordocError(`\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 \uCD9C\uB825 \uD655\uC7A5\uC790\uC785\uB2C8\uB2E4: ${ext || "(\uC5C6\uC74C)"} (\uD5C8\uC6A9: ${[...allowedExts].join(", ")})`);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/watch-P4WN723H.js:58 · Unicode escape sequence detected — may contain obfuscated payloads…74 \uD544\uC694\uD569\uB2C8\uB2E4 (\uD604\uC7AC ${nodeVersion}) \u2014 Node 20+ \uC5C5\uADF8\uB808\uC774\uB4DC\uB97C \uAD8C\uC7A5\uD569\uB2C8\uB2E4` ); } function createTaskQueue(maxConcurrent, …Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/mcp.js:151 · Unicode escape sequence detected — may contain obfuscated payloadsif (!allowedExts.has(ext)) throw new KordocError(`\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 \uD655\uC7A5\uC790\uC785\uB2C8\uB2E4: ${ext} (\uD5C8\uC6A9: ${[...allowedExts].join(", ")})`);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/mcp.js:155 · Unicode escape sequence detected — may contain obfuscated payloadsif (!outputPath) throw new KordocError("\uCD9C\uB825 \uACBD\uB85C\uAC00 \uBE44\uC5B4\uC788\uC2B5\uB2C8\uB2E4");Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/cli.js:257 · Unicode escape sequence detected — may contain obfuscated payloads…9C1\uB82C\uD654 \uD55C\uACC4\uB97C \uB118\uC5B4 \uD30C\uC77C \uCC38\uC870\uB85C \uB300\uCCB4\uD588\uC2B5\uB2C8\uB2E4 (${result.images.length}\uAC1C \u2192 images/${docStem}/) `); } }…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-YOAAZRJP.js:813 · Unicode escape sequence detected — may contain obfuscated payloadsvar RING_JAMO = "\u3131\u3134\u3137\u3139\u3141\u3142\u3145\u3147\u3148\u314A\u314B\u314C\u314D\u314E";Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/setup-U5XWE7T7.js:145 · Unicode escape sequence detected — may contain obfuscated payloadsawait typewrite(`${c.dim} \uBAA8\uB450 \uD30C\uC2F1\uD574\uBC84\uB9AC\uACA0\uB2E4 \u2501\u2501 HWP \xB7 HWPX \xB7 PDF \xB7 XLSX \xB7 DOCX \u2192 Markdown${c.reset}`, 10);Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈82 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for kordoc@4.24.59 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim chrisryugj: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim chrisryugjPropose a patch to the maintainer