qmd Local Search
v1.0.0Fast local search for markdown files, notes, and docs using qmd CLI. Use instead of `find` for file discovery. Combines BM25 full-text search, vector semantic search, and LLM reranking—all running locally. Use when searching for files, finding code, locating documentation, or discovering content in indexed collections.
⭐ 2· 2.6k·5 current·5 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly expects a local 'qmd' CLI to be present and describes collection/index operations. However, the skill metadata claims no required binaries or install steps. That mismatch (instructions assuming a binary that the manifest doesn't require) is incoherent and should be clarified.
Instruction Scope
Instructions are limited to running qmd to index and search local files, which fits the stated purpose. However wording like 'pull relevant snippets before answering questions' is broad and could lead to indexing or exposing sensitive local content unless the user scopes collections carefully.
Install Mechanism
There is no install spec, but SKILL.md states models are 'auto-downloaded' (embeddinggemma-300M, qwen3-reranker-0.6b, Qwen3-0.6B). The source, host, and trustworthiness of those downloads are unspecified — implicit large model downloads from unknown endpoints are a risk.
Credentials
The skill declares no required environment variables, credentials, or config paths, which is proportionate to a local-search tool. No environment secrets are requested.
Persistence & Privilege
The skill is instruction-only and not marked 'always', but manifest flags for model invocation are unset (default allows the model to invoke the skill). That means the agent could call the qmd commands autonomously if qmd exists — consider whether autonomous invocation is acceptable.
What to consider before installing
This skill appears to document how to use a local 'qmd' CLI, but there are two issues you should address before installing/using it: (1) The manifest does not list 'qmd' as a required binary even though all instructions assume it exists — confirm you will install qmd from a trusted source (official repo or package) and that the agent runtime will have the binary on PATH. (2) The SKILL.md says several models will be 'auto-downloaded' but doesn't state where from — verify the model hosting, bandwidth/storage requirements, and trustworthiness (prefer official model repos or allow only offline/air-gapped model use). Also: restrict which folders are added as collections to avoid indexing sensitive data, and consider disabling autonomous model invocation or requiring explicit user confirmation before the agent runs qmd commands. If the skill author can supply a clear install spec and model download sources, the incoherence would be largely resolved.Like a lobster shell, security has layers — review code before you run it.
latestvk973ktgb4hst76hmca6wcw0g0h8019wy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.