QMD Learning Loop

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:45 PM UTC
• Version: 1.1.0

Overview

The skill is a transparent learning-memory workflow that asks before making durable Markdown or QMD changes, with only setup and dependency caution notes.

Install only if you want an agent to help maintain durable local Markdown knowledge. Review each proposed learning before approval, avoid storing sensitive information, keep QMD collections limited to intended directories, and prefer pinned or reviewed versions when installing optional tools such as QMD.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: .github/workflows/validate.yml:18

Finding

Unpinned Remote Dependency Is Installed and Executed in CI

Content

View full analysis

Vulnerability Details

File Location: .github/workflows/validate.yml, lines 18–22
Vulnerability Type: Mutable third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

- name: Validate Agent Skills format
  run: |
    git clone --depth 1 https://github.com/agentskills/agentskills.git /tmp/agentskills
    python3 -m pip install /tmp/agentskills/skills-ref
    skills-ref validate "$GITHUB_WORKSPACE"

Technical Analysis

The workflow clones the current default branch of an external Git repository and installs its skills-ref package without pinning a reviewed commit. The effective dependency can therefore change independently of this repository.

Python package installation can execute code through its build backend and installation hooks. A compromise of the upstream repository, its maintainers, or its default branch could introduce code that executes automatically on the GitHub Actions runner during pip install.

The workflow limits GITHUB_TOKEN to read-only repository-content access, which reduces potential impact, but does not prevent malicious dependency code from reading the checked-out repository, accessing runner environment data, using outbound network connectivity, altering generated validation results, or interfering with later workflow steps.

Attack Path

1. An attacker compromises the upstream agentskills/agentskills repository, a maintainer account, or another mechanism controlling its default branch.
2. The attacker modifies the skills-ref package or its build configuration to execute malicious code during installation.
3. A push to main or a pull request triggers the validation workflow.
4. The workflow clones the attacker-controlled current revision because no commit SHA is specified.
5. python3 -m pip install /tmp/agentskills/skills-ref invokes the malicious build or installation logic.
6. The payload executes with the privileges of the GitHub-hosted runner and the workflow's avail ...[truncated 609 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the external repository to a reviewed full commit SHA rather than cloning its mutable default branch.
• Verify the checked-out commit before installation.
• Prefer a trusted, versioned package artifact with cryptographic hashes and install it using a hash-locked requirements file and pip --require-hashes.
• Keep the workflow token at its existing least-privilege level.
• Restrict outbound network access during validation where the CI platform permits it.
• Pin third-party GitHub Actions, including actions/checkout, to full commit SHAs for additional supply-chain hardening.
• Use dependency update automation to propose and review pin changes explicitly.

T08 · Insecure Dependencies

Note

• Location: README.md:33

Finding

Documentation Recommends Installing an Unpinned Global QMD Package

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 33–38
Vulnerability Type: Unpinned global package installation
Risk Level: Low

Vulnerable Code

bash

npm install -g @tobilu/qmd
qmd collection add /path/to/markdown --name workspace
qmd update

Technical Analysis

The installation guidance requests the latest available version of @tobilu/qmd rather than a reviewed exact version. The command also installs the package globally, increasing its reach in the user's environment. npm installation may execute package lifecycle scripts with the privileges of the user performing the installation.

As a result, the dependency installed by a future user may differ from the version considered when this Skill was reviewed. A compromised package publisher, registry account, or newly malicious release could turn the documented installation step into a code-execution channel.

The package uses a scoped name and the documentation links to its upstream project, reducing accidental typosquatting risk. QMD is also explicitly optional, so exploitation requires a user to follow this separate installation instruction.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its release process.
2. The attacker publishes a malicious new version under @tobilu/qmd.
3. A user follows the README command without specifying a version.
4. npm resolves and globally installs the malicious latest version.
5. Malicious lifecycle code executes with the installing user's privileges, or malicious behavior runs when the user later invokes qmd.
6. The globally installed command can affect QMD operations and files accessible to that user.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running npm and could affect files, environment data, and network resources available to that account. Global installation also makes the compromised command available beyond this project. ...[truncated 230 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned package reference with a reviewed exact version, such as @tobilu/qmd@X.Y.Z.
• Publish and verify the expected package integrity digest.
• Prefer a project-local, lockfile-controlled installation instead of a global installation where practical.
• Document the package provenance and provide instructions for reviewing dependency changes before upgrading.
• Consider using npm ci with a committed lockfile in controlled environments.
• Avoid elevated privileges for npm installation.
• Where compatible with the package, consider disabling lifecycle scripts during installation and enabling only explicitly required setup steps after review.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes an operational memory/learning skill for capturing and promoting durable learnings. The supplied code does not implement any reflection, memory capture, QMD indexing, or promotion workflow. Instead, it performs static validation of repository files and documentation requirements for the skill package. This is a materially different primary purpose, so the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/evaluation-cases.md (reported line 32)May include surrounding context.

md

| A new organization-wide policy | Authoritative; explicit approval required. |
| A lesson duplicates an existing rule | Update evidence or occurrence count instead of creating another rule. |
| A candidate contradicts an owned policy | Mark `needs-review`; do not overwrite either rule. |
| No suitable destination exists | Propose a path and alternative; do not create it without approval. |

## Privacy and reporting

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN