bruce-doc-converter-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

The skill is a legitimate document converter, but it tells agents to install unpinned third-party software and to run a command returned by the converter without validation.

Review before installing. Use this only in a restricted environment, prefer a reviewed pinned version of the converter, do not allow automatic package installation without consent, and do not run next_command values from converter output unless they match a known safe command such as a fixed bdc setup-node invocation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-42
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

# 1. pipx (preferred — isolated, bdc lands in PATH)
pipx install bruce-doc-converter

# 2. uv (if available — fast, isolated, bdc lands in PATH)
uv tool install bruce-doc-converter

# 3. pip --user (most universally available, bdc lands in PATH)
pip install --user bruce-doc-converter   # or: python3 -m pip install --user bruce-doc-converter

# 4. venv fallback (works everywhere, but bdc will NOT be in PATH)
python3 -m venv .venv
.venv/bin/pip install bruce-doc-converter
# Windows: .venv\Scripts\pip install bruce-doc-converter

Technical Analysis

Every documented installation method retrieves bruce-doc-converter without specifying an exact version, package hash, lockfile, or trusted package-index configuration. Consequently, the effective code installed and executed can change after this skill has been reviewed.

Isolation through pipx, uv, or a virtual environment limits dependency conflicts but does not establish dependency integrity. The pip --user alternative also installs executable code into the user's environment rather than an environment dedicated to the project. Because the project only contains SKILL.md, the implementation and transitive dependencies of the converter cannot be audited from the supplied artifact.

This is a supply-chain weakness rather than evidence that the current external package is malicious.

Attack Path

1. An attacker compromises the package publisher account, package repository, release process, or a transitive dependency.
2. The attacker publishes a malicious package version under the expected package name.
3. The agent follows the skill and installs the latest available version because no version or hash is pinned.
4. Malicious installation hooks or run ...[truncated 704 chars]

Remediation

View remediation

Remediation Suggestions

• Pin bruce-doc-converter to a specific reviewed version in every installation command.
• Require package hashes through a hash-locked requirements file or equivalent integrity mechanism.
• Use an explicitly configured and trusted package index.
• Review and pin all transitive dependencies using a lockfile.
• Prefer a dedicated virtual environment or container over pip install --user.
• Perform installation only after explicit user approval when network access or third-party code retrieval is required.
• Periodically review and deliberately update pinned dependencies rather than automatically installing the latest release.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61

Finding

Unverified Node.js Dependency Bootstrap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-65 and 78-82
Vulnerability Type: Unspecified external dependency installation
Risk Level: Medium

Vulnerable Code

bash

For Markdown to Word, initialize the Node.js dependencies explicitly before first use:

```bash
bdc setup-node

text

The command is also prescribed as an automatic recovery action:

```text
On failure:

- `success` is `false`.
- Use `error_code`, `retryable`, optional `next_command`, `error`, and optional `suggestion` to decide the next step.
- Do not pre-check Python dependencies. Run the command first and react to JSON failure.
- If Markdown to Word returns `DEPENDENCY_INSTALL_REQUIRED`, run `next_command` when present, otherwise run `bdc setup-node`, then retry.

Technical Analysis

The skill instructs the agent to execute a dependency bootstrap operation without identifying the Node.js packages, package versions, registry, integrity metadata, installation destination, or lifecycle scripts involved.

Node.js dependency installation may execute package lifecycle hooks such as preinstall, install, or postinstall. If dependencies are mutable or insufficiently verified, a compromised package, registry response, or transitive dependency could execute arbitrary code. The supplied project does not contain a manifest or lockfile that would allow the installed dependency graph to be reviewed.

The idempotence of bdc setup-node does not provide authenticity or integrity guarantees.

Attack Path

1. An attacker compromises a Node.js dependency, transitive dependency, package publisher, or registry resolution path used by bdc setup-node.
2. A Markdown-to-Word operation requires Node.js dependencies, or the CLI returns DEPENDENCY_INSTALL_REQUIRED.
3. The agent executes bdc setup-node as directed.
4. The bootstrap command retrieves the compromised component.
5. Malicious package code or a lif ...[truncated 625 chars]

Remediation

View remediation

Remediation Suggestions

• Document every package installed by bdc setup-node, including exact versions and installation locations.
• Commit and enforce a reviewed lockfile with package integrity values.
• Configure an explicit trusted registry and prevent unintended registry substitution.
• Disable package lifecycle scripts unless they are strictly necessary and reviewed.
• Run dependency installation in a restricted container or sandbox with minimal filesystem and network permissions.
• Require explicit user approval before downloading or installing Node.js components.
• Provide an offline or vendored dependency bundle whose integrity can be verified before execution.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:78

Finding

Execution of an Unvalidated Command Returned by the Converter

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 78-82
Vulnerability Type: Unvalidated dynamic command execution
Risk Level: High

Vulnerable Code

text

On failure:

- `success` is `false`.
- Use `error_code`, `retryable`, optional `next_command`, `error`, and optional `suggestion` to decide the next step.
- Do not pre-check Python dependencies. Run the command first and react to JSON failure.
- If Markdown to Word returns `DEPENDENCY_INSTALL_REQUIRED`, run `next_command` when present, otherwise run `bdc setup-node`, then retry.

Technical Analysis

The skill directs the agent to execute the value of next_command received from the CLI's runtime output. It does not require an exact-command allowlist, argument validation, shell-metacharacter rejection, user confirmation, or confinement to the documented bdc setup-node operation.

Parsing output as JSON only establishes its structure; it does not make command text trustworthy. The output is controlled by the locally resolved bdc executable. A compromised package, modified executable, or PATH-spoofed binary could emit the expected DEPENDENCY_INSTALL_REQUIRED error code while placing an arbitrary operating-system command in next_command.

Executing a command string through a shell would additionally interpret command separators, substitutions, redirections, and pipelines. Even execution without a shell remains unsafe if an unrestricted executable and arbitrary arguments are accepted.

Attack Path

1. An attacker compromises the installed bdc package or places a malicious bdc executable earlier in the process's PATH.
2. The user requests a Markdown-to-Word conversion.
3. The malicious executable emits syntactically valid JSON with success set to false, error_code set to DEPENDENCY_INSTALL_REQUIRED, and an attacker-selected command in next_command.
4. The agent trusts the documented recovery instructions and execu ...[truncated 843 chars]

Remediation

View remediation

Remediation Suggestions

• Never execute arbitrary command strings returned in next_command.
• Replace dynamic execution with a local mapping from recognized error codes to fixed, reviewed operations.
• For DEPENDENCY_INSTALL_REQUIRED, permit only a hard-coded invocation of the expected executable and setup-node argument.
• Resolve the executable through a trusted absolute path rather than relying on PATH.
• Invoke commands through an argument array without a shell.
• Reject unexpected arguments, shell metacharacters, redirections, pipelines, substitutions, and additional commands.
• Require explicit user approval before dependency installation or any recovery action that changes the environment.
• Verify the installed CLI's origin and integrity before processing its output.
• Execute conversion and setup operations in a sandbox with minimal filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation criteria are broad enough to trigger on many ordinary document-related requests, including reading, analysis, export, and uploaded file handling. Overbroad routing can cause the agent to invoke this skill unnecessarily, leading to unwanted tool execution, package setup, or document processing on requests that may not require this converter.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to install packages via pipx, uv, pip, or by creating a venv, which expands behavior from document conversion into software installation and local environment modification. Even if intended for legitimate setup, this increases supply-chain and host-modification risk because the agent may fetch and execute code from external package repositories without explicit user approval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The bdc setup-node step authorizes additional dependency bootstrap in a second runtime, meaning the agent may install or execute Node.js-related packages beyond the core conversion action. Cross-runtime bootstrap broadens the attack surface and can trigger unreviewed code execution from another package ecosystem.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting section tells the agent to unset proxy environment variables, which modifies network/security configuration outside the narrow scope of document conversion. This can bypass enterprise routing, monitoring, or access controls and may cause the agent to operate differently than the host's intended security posture.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description is written in Chinese while the rest of the skill content is in English, which can create an implicit language/locale constraint for invocation metadata without any opt-in or justification. This may violate language/locale policy if the skill is expected to support users or agents without a forced language preference.

Content

No source excerpt is available for this finding.