Is kordoc-parse-document safe to install?

SaferSkills independently audited kordoc-parse-document (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/kordoc-parse-document/SKILL.md · 1 file

skills/kordoc-parse-document/SKILL.md1.9 KB · Markdown

name: kordoc-parse-document

description: Use when converting Korean document files into readable text with `npx` and kordoc. Covers HWP, HWPX, and PDF parsing to Markdown or JSON, including metadata, outline, warnings, and page count. Trigger for requests such as reading a government document, extracting document contents, summarizing a Korean office file, or parsing a local .hwp/.hwpx/.pdf with `kordoc:parse_document`.

kordoc: parse_document

Use the public CLI first. This skill maps to the parse_document intent in src/mcp.ts, but without MCP.

Input Requirements

Require exactly one target document.
Require the user to attach the document or provide a concrete local path.
Accept only supported formats: .hwp, .hwpx, .pdf.
Do not proceed if the document is missing or the path is ambiguous.

Default Command

npm exec --yes --package=kordoc --package=pdfjs-dist -- \
  kordoc /abs/path/document.hwpx

Use JSON when the caller needs blocks or metadata:

npm exec --yes --package=kordoc --package=pdfjs-dist -- \
  kordoc /abs/path/document.hwpx --format json --silent

Workflow

Resolve the target file to an absolute path.
Confirm the extension is .hwp, .hwpx, or .pdf.
Use plain CLI output for human reading.
Use --format json when the task needs metadata, outline, warnings, or blocks.
Summarize the parsed content instead of dumping the whole document unless the user asked for raw output.

Guardrails

Install pdfjs-dist alongside kordoc; the package may fail to load without it.
Preserve warnings about image-based PDFs, skipped elements, or hidden text filtering.
Do not claim OCR happened unless the execution path explicitly used an OCR-capable custom script.
If the file is large, summarize key sections first.
Refuse to continue when no supported document was provided.

kordoc-parse-document— agent skill

Is kordoc-parse-document safe to install?

kordoc: parse_document

Input Requirements

Default Command

Workflow

Guardrails

Audit the pieces. Scan the whole. Decide.