Qmd2

Local search/indexing CLI (BM25 + vectors + rerank) with MCP mode.

Security Scan

The skill is internally consistent with its stated purpose (a local qmd CLI helper); the only noteworthy items are a referenced environment variable (OLLAMA_URL) that isn't declared in the metadata and the install step which pulls a Node package from a GitHub repo (normal but deserves review).

Purpose & Capability

Name/description match the required binary 'qmd' and the SKILL.md only documents using qmd for indexing/searching local files. The declared install (provides qmd) aligns with the stated purpose.

Instruction Scope

Runtime instructions are narrowly scoped to qmd CLI operations (indexing, search, status, MCP mode) and reference the index location (~/.cache/qmd). They also mention using Ollama via OLLAMA_URL (default http://localhost:11434) — this env var is referenced but not declared in the skill's requires.env metadata.

Install Mechanism

Install spec is a Node package pointing at a GitHub repository (https://github.com/tobi/qmd). This is a common pattern but has moderate risk: npm/node installs can run lifecycle scripts (arbitrary code at install time). The source is a GitHub repo (better than an unknown IP or pastebin) but you should review the repo before installing.

Credentials

The skill declares no required credentials (good). It does reference OLLAMA_URL for embeddings/rerank, which is a benign configuration variable (endpoint URL) but it was not declared. No secrets or unrelated credentials are requested.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent system privileges. It notes the index location in the user's cache directory (~/.cache/qmd), which is reasonable for this tool.

Assessment

This skill appears to be what it says: helper instructions for the qmd CLI. Before installing or running: (1) inspect the GitHub repository (https://github.com/tobi/qmd) to confirm you trust the maintainer and to check for install scripts or unexpected behavior; (2) be aware that npm installs can execute lifecycle scripts — consider installing in a sandbox/container if you are unsure; (3) the tool expects an Ollama instance for embeddings/rerank (OLLAMA_URL, default http://localhost:11434) — ensure you run a trusted local Ollama or adjust configuration; (4) check that writing an index to ~/.cache/qmd is acceptable for your environment and that you don’t index sensitive files unintentionally; (5) if you want stronger assurance, run qmd's source code through a brief audit or run it with network monitoring to see outbound activity during use.

qmd

Use qmd to index local files and search them.

Indexing

• Add collection: qmd collection add /path --name docs --mask "**/*.md"
• Update index: qmd update
• Status: qmd status

Search

• BM25: qmd search "query"
• Vector: qmd vsearch "query"
• Hybrid: qmd query "query"
• Get doc: qmd get docs/path.md:10 -l 40

Notes

• Embeddings/rerank use Ollama at OLLAMA_URL (default http://localhost:11434).
• Index lives under ~/.cache/qmd by default.
• MCP mode: qmd mcp.