QMD Markdown Search

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:26 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent qmd usage guide for local Markdown search, with install and data-exposure cautions users should understand before indexing private notes.

Install only if you trust the qmd upstream repository and are comfortable with a global CLI install. Use narrow collections rather than broad private folders, review what is indexed before embedding, avoid LLM-backed query mode for sensitive material unless you know the configured provider path, and run the MCP server only for trusted local clients.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Global Dependency Installation from a Mutable GitHub Repository## Vulnerability Details **File Location**: `SKILL.md`, lines 10–12 **Vulnerability Type**: Supply-chain risk caused by an unpinned remote dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash bun install -g https://github.com/tobi/qmd ``` ``` The dependency requirement is also documented in `SKILL.md` line 3: ```yaml description: Search and retrieve markdown documents from local knowledge bases using qmd. Supports BM25 keyword search, vector semantic search, and hybrid search with LLM re-ranking. Use for querying indexed notes, documentation, meeting transcripts, and any markdown-based knowledge. Requires qmd CLI installed (bun install -g https://github.com/tobi/qmd). ``` ### Technical Analysis The installation command references a mutable GitHub repository without specifying a reviewed release tag, immutable commit hash, package version, or integrity digest. Consequently, the code installed by this instruction can change after the Skill has been reviewed. Installing the package globally increases the potential impact because the resulting executable becomes available across the user's environment. If the upstream repository, maintainer account, dependency chain, or repository configuration is compromised, altered package code or installation hooks may execute with the privileges of the user running `bun install`. The repository is not proven malicious by the audited files. The vulnerability is the absence of dependency pinning and integrity controls, which creates an exploitable supply-chain trust boundary. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or a dependency used by the remote package. 2. The attacker introduces malicious package code or an installation lifecycle hook into the repository revision resolved by the unpinned URL. 3. A user follows the Skill's documented command: `bun install -g https://github.com/tob ...[truncated 1011 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed immutable commit hash or a cryptographically verified release rather than the repository's changing default revision. 2. Prefer a trusted package registry release with an explicit version and integrity metadata. 3. Use a lockfile and verify checksums or signatures before installation. 4. Avoid global installation where possible. Install the dependency in a dedicated project, sandbox, container, or isolated user environment with minimal permissions. 5. Review package lifecycle scripts and transitive dependencies before approving upgrades. 6. Establish a controlled update process in which new revisions are audited and tested before changing the pinned version. 7. Document the expected publisher, repository, version, commit hash, and integrity value so users can verify the downloaded artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly promotes `query` as a high-quality search mode using LLM re-ranking, but it does not warn that this can send user queries and potentially retrieved local document content to an external model/provider. In a skill centered on searching local knowledge bases and notes, that omission can cause users to expose sensitive internal material under the assumption the workflow is fully local.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup and MCP/server examples encourage indexing `~/notes`, generating embeddings, and exposing qmd as an MCP server without any caution about sensitive local content becoming searchable or accessible through another interface. In the context of personal notes, meeting transcripts, and documentation, this increases the risk of accidental disclosure of confidential data to local agents, connected clients, or downstream tools.

Static analysis

No suspicious patterns detected.