← Back to Skills Marketplace
34
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install qmd-hardened
Description
Local search/indexing CLI (BM25 + vectors + rerank) with MCP mode.
Usage Guidance
This skill appears to be a straightforward helper for the qmd CLI and is coherent with what it asks for. Two practical precautions before installing or using it: (1) Review the GitHub repo/package (https://github.com/tobi/qmd) so you know what code will be installed — npm/GitHub installs can execute arbitrary code. (2) Never set OLLAMA_URL to a remote/non-localhost endpoint unless you intentionally want your indexed content sent to that service; the SKILL.md warns that embeddings are transmitted to OLLAMA_URL and recommends keeping it local. Also follow the guardrails in SAFETY.md: confirm before deleting ~/.cache/qmd, never pipe qmd output to network commands, and redact any secrets found in search results.
Capability Analysis
Type: OpenClaw Skill
Name: qmd-hardened
Version: 1.0.0
The bundle provides a local file indexing and search utility (qmd) with a strong focus on security hardening. The SKILL.md file contains explicit defensive instructions (guardrails) to prevent the AI agent from exfiltrating data via network pipes, exposing credentials in search results, or misconfiguring the OLLAMA_URL to non-localhost endpoints. The SAFETY.md file provides a comprehensive rationale and test cases for these protections, and the installation source (github.com/tobi/qmd) appears to be a legitimate public repository.
Capability Assessment
Purpose & Capability
Name/description match the requirements and instructions: the skill requires the 'qmd' binary and provides commands for indexing/searching local files. The declared install (a node package from a GitHub repo that creates the 'qmd' binary) is coherent with the stated purpose.
Instruction Scope
SKILL.md only instructs use of qmd CLI commands and documents expected behaviour (index location, Ollama usage, MCP mode). It also includes explicit safety guardrails (confirm before destructive ops, avoid piping output to network, redact secrets). There are no instructions to read or transmit unrelated system data.
Install Mechanism
The install spec pulls a Node package from a GitHub repository (https://github.com/tobi/qmd) and installs the 'qmd' binary. Installing code from a third‑party GitHub repo/npm can be reasonable for a CLI but carries standard supply-chain risk — review the repo/source before installing.
Credentials
The skill does not require environment variables or credentials. It documents OLLAMA_URL (default localhost) for embeddings; this is expected, and the SKILL.md explicitly warns not to set it to a non-localhost endpoint because embeddings transmit indexed content.
Persistence & Privilege
The skill is not always-enabled, does not request to modify other skills or system-wide settings, and has no declared config path requirements. It does not demand elevated or persistent privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install qmd-hardened - After installation, invoke the skill by name or use
/qmd-hardened - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of qmd-hardened.
- Provides a local search and indexing CLI for documents with BM25, vector, and hybrid search modes.
- Features MCP mode for specialized operations.
- Utilizes Ollama for embedding and rerank operations (local endpoint required).
- Storage, index management, and search commands documented.
- Enhanced with security guardrails: prevents leaking data, unsafe output handling, destructive actions without confirmation, and redacts sensitive content from search results.
Metadata
Frequently Asked Questions
What is Qmd Hardened?
Local search/indexing CLI (BM25 + vectors + rerank) with MCP mode. It is an AI Agent Skill for Claude Code / OpenClaw, with 34 downloads so far.
How do I install Qmd Hardened?
Run "/install qmd-hardened" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Qmd Hardened free?
Yes, Qmd Hardened is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Qmd Hardened support?
Qmd Hardened is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Qmd Hardened?
It is built and maintained by Faberlens (@snazar-faberlens); the current version is v1.0.0.
More Skills