ClawHub
Back to skill

Security audit

QMD Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward helper for searching local Markdown notes, with setup and indexing risks the user should understand before use.

Before installing, review the qmd repository or pin a trusted version if possible, avoid running the install with elevated privileges, and only add collections that you are comfortable indexing and searching through this tool.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:56
Finding

Unpinned Global Installation from a Mutable Git Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–66
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash
## Setup (if qmd not installed)

```bash
# Install qmd
bun install -g https://github.com/tobi/qmd

# Add a collection (e.g., Obsidian vault)
qmd collection add ~/path/to/vault --name notes

# Generate embeddings for vector search
qmd embed --collection notes
text

### Technical Analysis

The installation instruction retrieves a third-party dependency directly from a mutable Git repository without specifying an immutable commit, verified release version, or integrity checksum:

```bash
bun install -g https://github.com/tobi/qmd

Because the repository reference is unpinned, the code installed by this command may differ from the code that was originally reviewed. If the upstream repository, maintainer account, or release process is compromised, an attacker could introduce malicious package code or installation lifecycle behavior. The use of global installation increases the potential scope by placing the resulting command in the user's global executable environment.

The project itself does not contain malicious executable code, and exploitation depends on an upstream supply-chain compromise or an unauthorized change to the referenced repository.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another part of its publishing workflow.
  2. The attacker modifies the package or its installation lifecycle behavior to execute malicious code.
  3. A user or agent follows the setup instructions and runs the unpinned global installation command.
  4. Bun retrieves the repository's current mutable state rather than a previously reviewed immutable revision.
  5. Malicious installation code executes with the privileges of the invoking user.
  6. The attacker-controlled package is installed as a globally available command and m ...[truncated 541 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed immutable commit hash or a specific trusted release rather than installing from the repository's mutable default branch.
  2. Prefer an official package registry release with a lockfile and integrity metadata, where available.
  3. Verify downloaded source or release artifacts using a documented cryptographic checksum or signature.
  4. Avoid global installation where possible. Install the dependency in an isolated project environment or controlled tool directory with minimum required privileges.
  5. Review package installation scripts and transitive dependencies before approving installation.
  6. Document the expected upstream repository owner, approved version, commit identifier, and verification procedure.
  7. Do not run the installation command with administrative privileges unless explicitly required and independently justified.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.