qmd
Verdict safe, but 1 finding (1 medium), mainly data exfiltration. Most recent scan 2026-02-07.
The qmd skill is a relatively safe wrapper around a local markdown search tool with minor security concerns. The primary risk is the unpinned GitHub installation which creates a supply chain vulnerability. The skill does not contain malicious code, prompt injection attempts, data exfiltration, or credential theft. It operates as a legitimate search utility for local markdown files. The missing metadata fields (license, compatibility, allowed-tools) are informational issues rather than security threats. The referenced but missing Python files appear to be documentation artifacts. Overall, this skill poses LOW to MEDIUM risk, with the main concern being the external dependency installation method.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections.
- Package
- 1 file, 4.7 KB
- SKILL.md
- 655 words, 12+ sections
- Code
- None. Instructions only.
- Requires
- bins:
qmd - Homepage
- https://github.com/tobi/qmd
SKILL.md covers: qmd - Quick Markdown Search · When to use (trigger phrases) · Default behavior (important) · Prerequisites · Install · Setup · What it indexes · Search modes · Performance notes · Common commands · Useful options · Retrieve
Findings
MEDIUM External Package Installation from GitHub Data Exfiltrationllm
The skill instructs installation of the 'qmd' package directly from a GitHub repository URL without version pinning or integrity verification. This creates a supply chain risk where the repository owner could push malicious updates that would be automatically installed.
SKILL.md
bun install -g https://github.com/tobi/qmdWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 4.7 KB |
External hosts referenced
github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
XDG_CACHE_HOME
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/qmd-external
- Raw scan result: qmd-external-knowledge-base-search-scan.json
- Badge for your README:
- Request a re-scan