QMD Learning Loop

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:45 PM UTC
• Version: 1.1.0

Overview

The skill is a transparent learning-memory workflow that asks before making durable Markdown or QMD changes, with only setup and dependency caution notes.

Install only if you want an agent to help maintain durable local Markdown knowledge. Review each proposed learning before approval, avoid storing sensitive information, keep QMD collections limited to intended directories, and prefer pinned or reviewed versions when installing optional tools such as QMD.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: .github/workflows/validate.yml:18
• Finding: Unpinned Remote Dependency Is Installed and Executed in CI## Vulnerability Details **File Location**: `.github/workflows/validate.yml`, lines 18–22 **Vulnerability Type**: Mutable third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml - name: Validate Agent Skills format run: | git clone --depth 1 https://github.com/agentskills/agentskills.git /tmp/agentskills python3 -m pip install /tmp/agentskills/skills-ref skills-ref validate "$GITHUB_WORKSPACE" ``` ### Technical Analysis The workflow clones the current default branch of an external Git repository and installs its `skills-ref` package without pinning a reviewed commit. The effective dependency can therefore change independently of this repository. Python package installation can execute code through its build backend and installation hooks. A compromise of the upstream repository, its maintainers, or its default branch could introduce code that executes automatically on the GitHub Actions runner during `pip install`. The workflow limits `GITHUB_TOKEN` to read-only repository-content access, which reduces potential impact, but does not prevent malicious dependency code from reading the checked-out repository, accessing runner environment data, using outbound network connectivity, altering generated validation results, or interfering with later workflow steps. ### Attack Path 1. An attacker compromises the upstream `agentskills/agentskills` repository, a maintainer account, or another mechanism controlling its default branch. 2. The attacker modifies the `skills-ref` package or its build configuration to execute malicious code during installation. 3. A push to `main` or a pull request triggers the validation workflow. 4. The workflow clones the attacker-controlled current revision because no commit SHA is specified. 5. `python3 -m pip install /tmp/agentskills/skills-ref` invokes the malicious build or installation logic. 6. The payload executes with the privileges of the GitHub-hosted runner and the workflow's avail ...[truncated 609 chars]
• Remediation: ## Remediation Suggestions - Pin the external repository to a reviewed full commit SHA rather than cloning its mutable default branch. - Verify the checked-out commit before installation. - Prefer a trusted, versioned package artifact with cryptographic hashes and install it using a hash-locked requirements file and `pip --require-hashes`. - Keep the workflow token at its existing least-privilege level. - Restrict outbound network access during validation where the CI platform permits it. - Pin third-party GitHub Actions, including `actions/checkout`, to full commit SHAs for additional supply-chain hardening. - Use dependency update automation to propose and review pin changes explicitly.

T08 · Insecure Dependencies

Note

• Location: README.md:33
• Finding: Documentation Recommends Installing an Unpinned Global QMD Package## Vulnerability Details **File Location**: `README.md`, lines 33–38 **Vulnerability Type**: Unpinned global package installation **Risk Level**: Low ### Vulnerable Code ```bash npm install -g @tobilu/qmd qmd collection add /path/to/markdown --name workspace qmd update ``` ### Technical Analysis The installation guidance requests the latest available version of `@tobilu/qmd` rather than a reviewed exact version. The command also installs the package globally, increasing its reach in the user's environment. npm installation may execute package lifecycle scripts with the privileges of the user performing the installation. As a result, the dependency installed by a future user may differ from the version considered when this Skill was reviewed. A compromised package publisher, registry account, or newly malicious release could turn the documented installation step into a code-execution channel. The package uses a scoped name and the documentation links to its upstream project, reducing accidental typosquatting risk. QMD is also explicitly optional, so exploitation requires a user to follow this separate installation instruction. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or its release process. 2. The attacker publishes a malicious new version under `@tobilu/qmd`. 3. A user follows the README command without specifying a version. 4. npm resolves and globally installs the malicious latest version. 5. Malicious lifecycle code executes with the installing user's privileges, or malicious behavior runs when the user later invokes `qmd`. 6. The globally installed command can affect QMD operations and files accessible to that user. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running npm and could affect files, environment data, and network resources available to that account. Global installation also makes the compromised command available beyond this project. ...[truncated 230 chars]
• Remediation: ## Remediation Suggestions - Replace the unversioned package reference with a reviewed exact version, such as `@tobilu/qmd@X.Y.Z`. - Publish and verify the expected package integrity digest. - Prefer a project-local, lockfile-controlled installation instead of a global installation where practical. - Document the package provenance and provide instructions for reviewing dependency changes before upgrading. - Consider using `npm ci` with a committed lockfile in controlled environments. - Avoid elevated privileges for npm installation. - Where compatible with the package, consider disabling lifecycle scripts during installation and enabling only explicitly required setup steps after review.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose describes an operational memory/learning skill for capturing and promoting durable learnings. The supplied code does not implement any reflection, memory capture, QMD indexing, or promotion workflow. Instead, it performs static validation of repository files and documentation requirements for the skill package. This is a materially different primary purpose, so the description does not accurately represent the code's actual behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| A new organization-wide policy | Authoritative; explicit approval required. |
| A lesson duplicates an existing rule | Update evidence or occurrence count instead of creating another rule. |
| A candidate contradicts an owned policy | Mark `needs-review`; do not overwrite either rule. |
| No suitable destination exists | Propose a path and alternative; do not create it without approval. |

## Privacy and reporting

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Scope Creep

Low

• Category: Excessive Agency

Content

the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.