ClawHub
Back to skill

Security audit

Qmd

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local file indexing/search helper, with a real but disclosed install supply-chain risk from an unpinned GitHub dependency.

Install only if you are comfortable running qmd from its GitHub source. Prefer a pinned commit or reviewed release if available, and only add collections for directories whose contents you intend to make searchable and cached locally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Executable Dependency from a Mutable GitHub Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"clawdbot":{"emoji":"📝","requires":{"bins":["qmd"]},"install":[{"id":"node","kind":"node","package":"https://github.com/tobi/qmd","bins":["qmd"],"label":"Install qmd (node)"}]}}

Technical Analysis

The installation metadata directs the environment to install an executable Node dependency directly from https://github.com/tobi/qmd. The reference does not specify an immutable commit hash, a verified release version, or an integrity checksum.

Because the repository reference is mutable, the code retrieved during a future installation may differ from the version that was originally reviewed. Compromise of the upstream repository, its maintainer account, or the dependency delivery process could therefore introduce attacker-controlled installation or runtime code.

The project does not itself contain evidence that the referenced dependency is currently malicious. The vulnerability is the absence of dependency pinning and integrity verification, which prevents the installed artifact from being reliably tied to an audited revision.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another part of the dependency publication process.
  2. The attacker modifies the repository revision resolved by the unpinned GitHub URL.
  3. A user or automated environment installs the skill dependency using the declared metadata.
  4. The installer retrieves the modified source because no immutable revision or integrity value is enforced.
  5. Attacker-controlled installation or runtime code executes with the permissions of the user or service performing the installation.
  6. That code could access resources available to the process, including local files selected for indexing, the index cache ...[truncated 684 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed, immutable Git commit rather than a mutable repository reference.
  2. Prefer a trusted package registry release with an exact version when an appropriately maintained release is available.
  3. Verify the downloaded artifact using a cryptographic checksum or trusted signature.
  4. Record the resolved dependency and its transitive dependencies in a lockfile where supported.
  5. Review the pinned revision's installation scripts and runtime behavior before approval.
  6. Perform installation and execution under a least-privileged account or sandbox, limiting filesystem and network access to what indexing requires.
  7. Use automated dependency monitoring and require explicit review before updating the pinned revision.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.