Qmd

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:54 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed local Markdown search integration, with normal setup and local-query risks users should understand before indexing private notes.

Install only if you intend QMD to index and search the Markdown directories you add. Avoid indexing sensitive folders unnecessarily, consider pinning or otherwise verifying the @tobilu/qmd package before global installation, and only run the optional HTTP daemon if you want a local background service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:121

Finding

Unpinned Global npm Package Installation Creates Supply-Chain Code Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, SKILL.md:12, SKILL.md:121-125, and references/mcp-setup.md:3-8
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

The documentation repeatedly directs users to install the latest available version of @tobilu/qmd globally rather than an exact, reviewed version.

Complete relevant code from SKILL.md:

yaml

compatibility: Requires qmd CLI or MCP server. Install via `npm install -g @tobilu/qmd`.

markdown

## Status

!`qmd status 2>/dev/null || echo "Not installed: npm install -g @tobilu/qmd"`

markdown

## Setup

```bash
npm install -g @tobilu/qmd
qmd collection add ~/notes --name notes
qmd embed

text

Complete relevant code from `references/mcp-setup.md`:

```markdown
## Install

```bash
npm install -g @tobilu/qmd
qmd collection add ~/path/to/markdown --name myknowledge
qmd embed

text

### Technical Analysis

The npm command does not specify an exact package version or verify package integrity. It consequently resolves whatever version is associated with the package's current distribution tag at installation time. The effective dependency may therefore change after this Skill has been reviewed.

npm packages can contain lifecycle scripts and executable files. If the package, its publishing account, or a transitive dependency is compromised, installation can execute attacker-controlled code with the privileges of the user invoking npm. Global installation also places the package's executables and supporting files into shared user- or system-level npm locations, increasing the potential scope compared with an isolated project-local dependency.

This finding does not establish that the current `@tobilu/qmd` package is malicious. The vulnerability is the unsafe, unpinned installation workflow and its exposure to future supply-chain compromise.

### Attack Path

1. 
...[truncated 1656 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin QMD to an exact version that has been reviewed:

   bash

   npm install -g @tobilu/qmd@2.0.0
   

   Confirm the appropriate reviewed package version independently; the Skill metadata version does not necessarily prove the dependency version.

2. Prefer a project-local installation rather than a global installation:

   bash

   npm install --save-exact @tobilu/qmd@2.0.0
   

   Invoke the local binary through a controlled package script or explicit local path.

3. Commit and enforce a lockfile when using a project-local dependency. Use reproducible installation commands such as npm ci so transitive dependencies cannot change silently.

4. Verify package provenance and integrity before installation. Record the expected npm registry source and package integrity digest, and review package ownership, publication history, included files, and lifecycle scripts.

5. Disable lifecycle scripts where QMD supports installation without them:

   bash

   npm install --ignore-scripts --save-exact @tobilu/qmd@2.0.0
   

   If lifecycle scripts are required, document and review them before permitting execution.

6. Do not run the installation with sudo, as an administrator, or from another elevated shell. Use a dedicated, minimally privileged account where practical.

7. Update every installation reference in both SKILL.md and references/mcp-setup.md so users are not directed to fall back to the unsafe unpinned command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/mcp-setup.md (reported line 13)May include surrounding context.

Configure MCP Client

Claude Code (~/.claude/settings.json):

json

{
  "mcpServers": {

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description says to use this skill when users ask to "search notes, find documents, or look up information," which are very broad, everyday requests. Without narrower scope, exclusions, or explicit trigger constraints, this could cause the skill to activate for many generic information-seeking prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

HTTP API

bash

curl -X POST http://localhost:8181/query \
  -H "Content-Type: application/json" \
  -d '{"searches": [{"type": "lex", "query": "test"}]}'

Static analysis

No suspicious patterns detected.