QMD - Quick Markdown Search

Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections.

This skill appears to be a legitimate local markdown search helper that relies on the external 'qmd' binary and (optionally) local LLM models. Before installing, verify the upstream GitHub repo (https://github.com/tobi/qmd) so you know what code will be installed. Be aware that: (1) the first run can auto-download GGUF models into ~/.cache/qmd/models (large files and network activity), (2) installation uses 'bun install -g' which adds third-party code to your system, and (3) scheduling index/embedding jobs (cron or agent scheduler) will run qmd commands regularly against files you index. If you need stricter control, run qmd in a sandbox or VM, inspect the repository you install from, and confirm model download sources and network endpoints before allowing automatic downloads.

Type: OpenClaw Skill Name: qmd-markdown-search Version: 1.0.0 The skill is classified as suspicious due to the installation method and the inherent risks involved. The `SKILL.md` instructs the agent to install `qmd` via `bun install -g https://github.com/tobi/qmd`. This command downloads and executes code from a remote GitHub repository, introducing a supply chain risk. While the tool's stated purpose of local markdown search is benign, and the instructions to the agent are operational guidance rather than malicious prompt injection, the act of installing arbitrary remote code and granting it broad local file system and network access (for model downloads) constitutes a meaningful high-risk behavior without clear malicious intent, aligning with the 'suspicious' threshold.