{
  "skill_name": "qmd",
  "skill_path": "/workspace/skills/clawhub-qmd-external",
  "skill_directory": "/workspace/skills/clawhub-qmd-external",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_qmd_3",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "External Package Installation from GitHub",
      "description": "The skill instructs installation of the 'qmd' package directly from a GitHub repository URL without version pinning or integrity verification. This creates a supply chain risk where the repository owner could push malicious updates that would be automatically installed.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "bun install -g https://github.com/tobi/qmd",
      "remediation": "Pin to a specific commit hash or release tag (e.g., 'bun install -g https://github.com/tobi/qmd#v1.0.0'), verify package integrity, or use a published package registry with provenance tracking.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The qmd skill is a relatively safe wrapper around a local markdown search tool with minor security concerns. The primary risk is the unpinned GitHub installation which creates a supply chain vulnerability. The skill does not contain malicious code, prompt injection attempts, data exfiltration, or credential theft. It operates as a legitimate search utility for local markdown files. The missing metadata fields (license, compatibility, allowed-tools) are informational issues rather than security threats. The referenced but missing Python files appear to be documentation artifacts. Overall, this skill poses LOW to MEDIUM risk, with the main concern being the external dependency installation method.",
        "primary_threats": [
          "Supply Chain Risk (unpinned GitHub installation)",
          "Missing Provenance Metadata"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Clear supply chain risk - unpinned GitHub installation allows arbitrary code execution if repository is compromised or maliciously updated. This is a well-documented attack vector.",
        "meta_exploitability": "Medium - Requires repository compromise or malicious maintainer, but installation happens with user privileges",
        "meta_impact": "High - Could lead to arbitrary code execution during installation or runtime if malicious code is pushed to the repository"
      }
    }
  ],
  "scan_duration_seconds": 20.450222492218018,
  "duration_ms": 20450,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T19:44:23.837964"
}