qmd External Knowledge Base Search

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for local Markdown search, but users should be careful about which private folders they index and whether they enable the optional scheduled re-indexing.

This appears to be a normal local Markdown search skill. Before installing, make sure you trust the qmd CLI source, index only the folders you want the agent to search, and avoid enabling the optional cron job unless you want ongoing automatic re-indexing.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the skill's required tool may run code from an external project on the user's machine.

Why it was flagged

The skill relies on installing an external CLI globally from a GitHub source. This is disclosed and central to the skill, but it means trust in the upstream qmd project is required.

Skill content
`bun install -g https://github.com/tobi/qmd`
Recommendation

Install only if you trust the qmd upstream project, and consider pinning or reviewing the version you install.

What this means

The agent may be able to search and quote private local notes or documents that the user has indexed.

Why it was flagged

The skill indexes local Markdown files, creates embeddings, and can retrieve full documents. This is expected for a knowledge-base search tool, but indexed notes may contain private information.

Skill content
`qmd collection add /path/to/notes --name notes --mask "**/*.md"` ... `qmd embed` ... `--full`: return full document content
Recommendation

Index only specific folders intended for agent-assisted search, avoid broad home-directory collections, and exclude sensitive notes where possible.

What this means

If enabled, the index may be refreshed automatically on a schedule, including newly added Markdown files in the configured collections.

Why it was flagged

The skill documents an optional persistent scheduled job that silently runs re-indexing and embedding commands. It is disclosed and purpose-aligned, but it adds continuing background activity.

Skill content
Set up a cron job or hook to automatically re-index ... `# Via Clawdbot cron (isolated job, runs silently):`
Recommendation

Enable scheduled re-indexing only if desired, keep the indexed collection paths narrow, and know how to remove the cron job later.