bruce-doc-converter-skill

• Outcome: Review
• Latest audit: May 29, 2026 at 9:39 PM UTC
• Version:
  1.0.0

Overview

The skill is a coherent document converter, but it needs review because it tells the agent to install an unpinned external CLI and run a command returned by that CLI without narrowing what that command may be.

Install only if you are comfortable adding this external converter to your environment. Prefer pipx or a dedicated venv, use it only on files and folders you intend the agent to read, and do not approve any returned `next_command` unless it is clearly the expected `bdc setup-node` style dependency setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to install software and dependencies from package managers (`pipx`, `uv`, `pip`, venv, and `bdc setup-node`) as part of normal operation. That expands the skill from local document conversion into code/package acquisition with network access and supply-chain risk, which is materially more dangerous than the stated purpose. In an agent setting, automatic installation can also modify the host environment unexpectedly.

VirusTotal

62/62 vendors flagged this skill as clean.