ClawHub
Back to skill

Security audit

Qmd 1.0.0

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local document search skill, with the main caution that indexed files are stored in a local cache.

Install only if you are comfortable indexing the folders you choose. Use narrow paths and masks, avoid secrets or sensitive personal directories, review the external qmd package if supply-chain provenance matters to you, clear ~/.cache/qmd when you no longer need the index, and use MCP mode only with trusted clients.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill instructs users to index local files and notes the index is stored under `~/.cache/qmd`, but it does not clearly warn that file contents and metadata may be persisted locally as part of the search index. This can lead users to unknowingly ingest sensitive documents into a cache or search database, increasing exposure on shared systems or through later compromise of the local account.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.