Fixing Ghostwriter and PwnDoc Word Templates That Break

Most Ghostwriter and PwnDoc template failures come from a few rules about where a tag may sit. In Ghostwriter it is usually a prefixed tag sharing its paragraph or row, a style the template does not have, or a name the report data does not hold; in PwnDoc, formatted text or a picture that is not alone in its paragraph, or lists without the numbering the template needs. Here is what each tool’s documentation says, how to find the tag at fault, and how Pental takes the template code away.

Ghostwriter: the rules that break documents

• One prefixed tag per paragraph, row, cell or run. Following python-docx-template, a {%p, {%tr, {%tc or {%r tag may appear only once in its paragraph, row, column or run, and nothing else should sit beside a prefixed tag, because the whole element is replaced.
• Formatted text needs _rt and p. {{ finding.description }} prints raw HTML; {{p finding.description_rt }} prints what you see in the editor.
• Styles must exist in the file. Formatted text uses named styles, CodeBlock, CodeInline, Caption, Bullet List and Number List among them, and a style such as Caption does not exist in a template until you have applied or created it. A missing List Paragraph style once stopped a user generating any report at all, in an issue from August 2024, since closed.
• Names come from the report’s data. Its documentation’s advice is to generate the report as JSON and read what is there, since everything in it is available to a template; an error about something undefined usually means a name that is not.
• The linter decides. A template uploaded to the library is linted, and one whose status is failed or error cannot be used to generate a report.

Finding the fault in a Ghostwriter template

When Word says a generated report has unreadable content, Ghostwriter’s documentation explains that the Jinja2 ran outside Word, so nothing caught the problem first, and that letting Word repair the file is generally fine but can remove or change content. It offers no easy way to locate the cause, and suggests halving the template: delete half, upload it, generate a report, and repeat with the half that fails. Two habits keep the halving short:

• Change one thing at a time, and generate after each change from a report with every kind of finding in it, so a branch nobody reaches is still tested.
• Read the linter’s result after every upload before generating anything, since a template it fails cannot be used at all.

PwnDoc: the rules that break documents

• Raw and image tags stand alone. {@affected | convertHTML} must be the only thing in its paragraph, and so must an image tag.
• Named styles. To style what comes from the editors, the template must define HTMLTextStyle, Heading1 to Heading6, CodeChar and Code.
• Lists live in numbering.xml. Bullet and numbered lists must be set up in the template’s numbering.xml, opened with an archive manager, where PwnDoc uses numId 1 for bullets and 2 for numbered lists. Its documentation’s shortcut: add both kinds of list in Word, save, delete them and save again.
• Filters are Angular expressions, and a filter of your own means changing the back end’s code.
• Bookmarks longer than 40 characters are cut short by Word.

Finding the fault in a PwnDoc template

PwnDoc fills templates with docxtemplater, whose errors name the tag but not always where it sits. Raw tag not in paragraph, which PwnDoc users raised in its tracker in 2021 and 2023, means docxtemplater found a raw tag such as {@affected | convertHTML} outside a paragraph it could replace; retype it as plain text in a paragraph of its own. Raw tag should be the only text in paragraph means the tag shares its paragraph with other text, even a space. Beyond those:

• Search the document for every {@ and {% and check each is alone in its paragraph.
• Check every {#name} has its {/name}, and that a loop meant to repeat table rows opens and closes in the rows it repeats.
• When generation fails with no message at all, as a PwnDoc user reported in March 2026 with nothing in the back end’s logs, halve the template as you would for Ghostwriter.

Doing without the template code

Both tools ask the person who designs your report to write code inside a Word document and to find their mistakes without a debugger. Pental takes the code out of it:

• The Document Builder takes a report you already send and places each placeholder where it belongs, for you to check and save.
• The Placeholder Key lists every placeholder you can use, your own fields included, and the Draft is a template to start from with them in place.
• One name per value. A finding’s description arrives with its formatting from {description}, with no prefix, no second name and no numbering.xml to edit.
• Your old template, converted. Upload a Ghostwriter or PwnDoc template and each placeholder with a Pental equivalent becomes it, its loops, conditions and rows kept, with a list of what each became and what has no equivalent before anything is saved.

Converting a Ghostwriter or PwnDoc Word template shows every mapping, and what a penetration test report should contain is the checklist for what the template has to hold.