Security audit
Security checks across malware telemetry and agentic risk
LUCID appears purpose-built for memory retrieval, but it automatically injects broad QMD-indexed workspace content into the model's system prompt, which creates privacy and prompt-injection risks users should review.
Install only if you are comfortable with QMD-indexed workspace content being automatically recalled into model context. Before enabling, restrict what QMD indexes, verify qmdShimPath, avoid using it in highly sensitive sessions, and consider adding untrusted-content guards around retrieved snippets.
VirusTotal engine telemetry is currently stale for this artifact.
Detected: suspicious.dangerous_exec
const child = spawn(process.execPath, [config.qmdShimPath, "search", prompt, "-n", String(n), "--json"], { env: process.env, stdio: ["ignore", "pipe", "pipe"], ...const child = spawn(