{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-08-29","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Reads editable fields and revises Korean HWPX documents through HWPXkit. Fill forms, rewrite or format text, and add or remove table rows on a working copy. Download the result or undo the last edit; a free HWPXkit account is required.","did":"21f9a422-0143-450a-84aa-6126aab71f63","documentation_url":"https://hwpxkit.jhlim.dev/","editorial_description":{"extended_description":"Open an attached file or link in an expiring session. Inspection returns document structure and editable targets rather than the entire document body, and does not classify its subject matter. Supported targets include paragraphs, form cells, table rows and LaTeX equations. The original file is not modified.","schema_version":1,"summary":"Reads editable fields and revises Korean HWPX documents through HWPXkit.\nFill forms, rewrite or format text, and add or remove table rows on a working copy.\nDownload the result or undo the last edit; a free HWPXkit account is required."},"homepage_url":"","icon":"https://mcp.hwpxkit.jhlim.dev/favicon.png","id":"21f9a422-0143-450a-84aa-6126aab71f63","installs":0,"last_scanned":"","license":"","long_description":"Open an attached file or link in an expiring session. Inspection returns document structure and editable targets rather than the entire document body, and does not classify its subject matter. Supported targets include paragraphs, form cells, table rows and LaTeX equations. The original file is not modified.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"The Directory inventory contains apply_edits and rollback; the description says it can rewrite text, change formatting, and insert or delete table rows in a private working copy.","reasoning":"These are persistent changes to the generated document artifact, though the original source is described as unchanged.","risk_type":"data_modification","severity":"medium","title":"Edits uploaded HWPX working copies","triggering_tools_or_skills":["apply_edits","rollback"]}],"assessment_status":"provisional","auth_and_scopes":"OAuth authentication is required for private expiring document sessions; exact retention period, scopes and per-document authorization are not specified.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/21f9a422-0143-450a-84aa-6126aab71f63.json","what_it_proves":"Candidate PR #125 record identity (name \"HWPXkit\", publisher, type web_connector) and 6 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/21f9a422-0143-450a-84aa-6126aab71f63: complete tool_names inventory (6 tools), remote streamable-http endpoint https://mcp.hwpxkit.jhlim.dev/mcp-claude, auth_posture auth_required, directory tier community"}],"primary_reason":"HWPXkit modifies private document working copies and returns edited downloads, without an evidenced High action.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:21f9a422-0143-450a-84aa-6126aab71f63","reviewed_at":"2026-10-10","reviewer_notes":"The documentation homepage could not be fetched. open_document accepts an attachment or link, so URL-fetch restrictions and document-retention guarantees require runtime verification; closing transient session memory is not treated as destructive deletion of a user resource.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"true","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":6,"tools_or_skills_total":6},"name":"HWPXkit","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=21f9a422-0143-450a-84aa-6126aab71f63&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://hwpxkit.jhlim.dev/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Jeonghyeon Lim","publisher_url":"https://hwpxkit.jhlim.dev/","remote_url":"https://mcp.hwpxkit.jhlim.dev/mcp-claude","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent changes to the generated document artifact, though the original source is described as unchanged.","evidence":"Edits uploaded HWPX working copies: The Directory inventory contains apply_edits and rollback; the description says it can rewrite text, change formatting, and insert or delete table rows in a private working copy.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Edits uploaded HWPX working copies","triggering_tools":["apply_edits","rollback"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://hwpxkit.jhlim.dev/support","tags":["modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"analyze_document"},{"description":"","name":"apply_edits","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent changes to the generated document artifact, though the original source is described as unchanged."}},{"description":"","name":"close_document"},{"description":"","name":"list_targets"},{"description":"","name":"open_document"},{"description":"","name":"rollback","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent changes to the generated document artifact, though the original source is described as unchanged."}}],"tools_count":6,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/21f9a422-0143-450a-84aa-6126aab71f63","uuid":"08663520-777f-589e-bb1c-5a2c8c6f05ea","verification_tier":"community","version":""},"query_key":"hwpxkit","schema_version":1,"status":"match"}