Qmd2
v1.0.1Local search/indexing CLI (BM25 + vectors + rerank) with MCP mode.
⭐ 0· 36·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the required binary 'qmd' and the SKILL.md only documents using qmd for indexing/searching local files. The declared install (provides qmd) aligns with the stated purpose.
Instruction Scope
Runtime instructions are narrowly scoped to qmd CLI operations (indexing, search, status, MCP mode) and reference the index location (~/.cache/qmd). They also mention using Ollama via OLLAMA_URL (default http://localhost:11434) — this env var is referenced but not declared in the skill's requires.env metadata.
Install Mechanism
Install spec is a Node package pointing at a GitHub repository (https://github.com/tobi/qmd). This is a common pattern but has moderate risk: npm/node installs can run lifecycle scripts (arbitrary code at install time). The source is a GitHub repo (better than an unknown IP or pastebin) but you should review the repo before installing.
Credentials
The skill declares no required credentials (good). It does reference OLLAMA_URL for embeddings/rerank, which is a benign configuration variable (endpoint URL) but it was not declared. No secrets or unrelated credentials are requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent system privileges. It notes the index location in the user's cache directory (~/.cache/qmd), which is reasonable for this tool.
Assessment
This skill appears to be what it says: helper instructions for the qmd CLI. Before installing or running: (1) inspect the GitHub repository (https://github.com/tobi/qmd) to confirm you trust the maintainer and to check for install scripts or unexpected behavior; (2) be aware that npm installs can execute lifecycle scripts — consider installing in a sandbox/container if you are unsure; (3) the tool expects an Ollama instance for embeddings/rerank (OLLAMA_URL, default http://localhost:11434) — ensure you run a trusted local Ollama or adjust configuration; (4) check that writing an index to ~/.cache/qmd is acceptable for your environment and that you don’t index sensitive files unintentionally; (5) if you want stronger assurance, run qmd's source code through a brief audit or run it with network monitoring to see outbound activity during use.Like a lobster shell, security has layers — review code before you run it.
latestvk97cef4rm39fg54e7ceyhzahe5844819
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📝 Clawdis
Binsqmd
Install
Install qmd (node)
Bins: qmd
npm i -g https://github.com/tobi/qmd