doc-converter

No explicit malware behaviors (no network, credential harvesting, or persistence) are present in this snippet. However, the script uses eval to execute a dynamically constructed pandoc command that incorporates user-controlled inputs (file paths, formats, and options). This creates a substantial command-injection/arbitrary command execution risk in any environment where untrusted arguments can reach this wrapper. Rewrite to avoid eval (use exec/command with an argument array) and strongly allowlist/validate format and option values before invocation.