Qmd Memory 1.0.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:31 AM UTC
• Version: 1.0.0

Overview

This memory-search skill is not evidently malicious, but it needs review because setup can globally install an unpinned npm package and automatically index sensitive OpenClaw workspace files into persistent local search data.

Install only if you are comfortable with QMD indexing your OpenClaw Markdown files into a persistent local cache. Consider installing a reviewed/pinned QMD version yourself first, limiting OPENCLAW_WORKSPACE to a non-sensitive directory, removing secrets from Markdown before setup, checking ~/.cache/qmd retention, and using the MCP server only when localhost/shared-agent access is acceptable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:16
• Finding: Unpinned Global Installation of a Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 16-20 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Complete Code Snippet ```bash # Check if QMD is installed if ! command -v qmd &> /dev/null; then echo "📦 Installing QMD..." npm install -g @tobilu/qmd echo "✅ QMD installed" fi ``` ### Technical Analysis The setup script installs `@tobilu/qmd` without specifying an exact version, validating an integrity hash, or using a lockfile. Consequently, npm resolves the mutable package version associated with the registry's current default distribution tag. npm package installation can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Because the package is installed globally, those scripts execute with the permissions of the user running the skill and can modify files accessible to that user. The script also does not request confirmation immediately before installing the package or verify that npm is using an expected trusted registry. This does not establish that the current QMD package is malicious. The vulnerability is the unsafe dependency acquisition mechanism: future package changes, registry compromise, maintainer-account compromise, or registry configuration manipulation could turn the setup command into a code-execution path. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or the registry configuration used by the victim. 2. The attacker publishes a malicious release or changes the package's default distribution tag. 3. A user without an existing `qmd` executable invokes the skill's setup command. 4. `npm install -g @tobilu/qmd` resolves and downloads the attacker-controlled package version. 5. Malicious package code or lifecycle scripts execute with the invoking user's permissions. 6. The payload can access or modify files available to that user and may alter globally installed Node.j ...[truncated 778 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin QMD to an exact, reviewed version: ```bash npm install -g @tobilu/qmd@<audited-version> ``` 2. Record and validate the expected package integrity digest before installation. 3. Verify that npm is configured to use the intended HTTPS registry and reject unexpected registry overrides. 4. Prefer a project-local dependency with a lockfile instead of modifying global Node.js tooling. 5. Disable lifecycle scripts with `--ignore-scripts` if QMD does not require them; otherwise, audit all lifecycle scripts for the pinned release. 6. Prompt for explicit user consent before downloading and executing third-party package code. 7. Run installation and indexing as an unprivileged account, never through `sudo` or a privileged service. 8. Document the exact dependency version and provide a controlled update procedure that reviews new releases before adoption. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/setup.sh:25
• Finding: Broad Automatic Indexing of Sensitive Agent Memory and Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 25-51 **Vulnerability Type**: Excessive access to persistent Agent state **Risk Level**: Medium ### Complete Code Snippet ```bash # Create collections based on what exists if [ -d "$WORKSPACE/memory" ]; then echo "📁 Found: memory/ → Creating 'daily-logs' collection" qmd collection add "$WORKSPACE/memory" --name daily-logs --mask "**/*.md" 2>/dev/null || true qmd context add qmd://daily-logs "Daily work logs and session notes" 2>/dev/null || true fi if [ -d "$WORKSPACE/intelligence" ]; then echo "📁 Found: intelligence/ → Creating 'intelligence' collection" qmd collection add "$WORKSPACE/intelligence" --name intelligence --mask "**/*.md" 2>/dev/null || true qmd context add qmd://intelligence "Analysis, research, dashboards, and reference documents" 2>/dev/null || true fi if [ -d "$WORKSPACE/projects" ]; then echo "📁 Found: projects/ → Creating 'projects' collection" qmd collection add "$WORKSPACE/projects" --name projects --mask "**/*.md" 2>/dev/null || true qmd context add qmd://projects "Project documentation and work files" 2>/dev/null || true fi # Always create workspace collection for core files echo "📁 Creating 'workspace' collection for core agent files" qmd collection add "$WORKSPACE" --name workspace --mask "*.md" 2>/dev/null || true qmd context add qmd://workspace "Core agent files: MEMORY.md, SOUL.md, USER.md, TOOLS.md" 2>/dev/null || true ``` ### Technical Analysis The setup process automatically creates broad QMD collections for memory logs, intelligence documents, project files, and top-level workspace Markdown files. It explicitly targets persistent Agent files such as `MEMORY.md`, `SOUL.md`, `USER.md`, and `TOOLS.md`. Although indexing local memory is the skill's documented purpose, the implementation does not provide: - Per-directory or per-file consent. - A preview of files that will be indexed. - Default exclusions f ...[truncated 2239 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit opt-in for every directory or collection before indexing it. 2. Display a complete preview of matched files and obtain confirmation before processing them. 3. Exclude sensitive files such as `SOUL.md`, `USER.md`, private logs, credential files, and secret-bearing documents by default. 4. Support an exclusion file containing deny patterns, analogous to `.gitignore`. 5. Scan candidate documents for common secret formats and warn or stop before indexing. 6. Apply restrictive filesystem permissions to indexes, embeddings, model caches, and process metadata. 7. Run QMD under a dedicated least-privileged account where feasible. 8. Require authenticated, authorized access for MCP clients and restrict the service to the minimum necessary network interface. 9. Separate collections by sensitivity and enforce client-specific authorization rather than sharing every collection with every Agent. 10. Provide documented commands to inspect, remove, and securely rebuild collections and indexes. 11. Clearly disclose retention behavior and whether deleted source content remains recoverable from the index. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises nightly auto-updates and automatic setup behavior without clearly warning users that the skill may initiate network activity and modify local state on an ongoing basis. In an agent-skill context, hidden background downloads or updates can surprise operators, affect reproducibility, and expand supply-chain risk if remote resources change over time.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Stating that models download automatically on first run, especially with a ~2GB payload, without a prominent warning about network use and disk impact can lead to unexpected resource consumption and unreviewed third-party code/model retrieval. In a local agent environment, this also increases operational and supply-chain exposure because users may trigger the download implicitly during normal use.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The quick-start setup implies a simple installation, but elsewhere the skill reveals it auto-downloads roughly 2GB of models and builds local indexes from workspace documents. Omitting that warning undermines informed consent and may cause users to ingest sensitive files into a persistent search system without understanding the storage, bandwidth, and privacy implications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises automatic indexing and nightly cron updates but does not clearly warn users that local documents will be continually scanned, embedded, and stored on disk. This can expose sensitive workspace content to broader local persistence and increase privacy risk, especially if users do not realize the scan is ongoing or that additional folders may be indexed over time.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script performs a global package installation with `npm install -g @tobilu/qmd` if `qmd` is missing, which changes system state outside the workspace without any confirmation, dry-run option, or explicit notice of the scope of the change. In an agent skill context, setup scripts may be run with elevated trust, so silent global installs increase risk of unintended system modification and supply-chain exposure from downloading and executing external package install hooks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script automatically scans workspace directories and creates searchable collections over markdown content, then runs indexing and embedding generation, without a clear privacy or data-handling consent step. Even though it targets local files, this can expose sensitive notes, project documents, or intelligence files to broader local search surfaces and potentially to downstream tooling behavior the user may not expect.

Static analysis

No suspicious patterns detected.