Combines M-Flow graph topology and QMD BM25+vector retrieval to merge and rank results for precise multi-hop and semantic search.

This skill does what it claims (combines M-Flow and QMD results) but the implementation reads a hard-coded local QMD SQLite database and dynamically loads a local 'm-flow' module without declaring those accesses. Before installing or running: - Treat this as potentially accessing private local documents (QMD DB). Do not run it in an environment with sensitive data unless you reviewed or sandboxed it. - Inspect or run the scripts in a safe, isolated environment (disposable VM or container). Confirm the C:/Users/Administrator/.cache/qmd/index.sqlite path and any data it contains. - If you expect to use it, ask the author to parameterize the DB path and m-flow location (don’t hard-code C:\Users\Administrator...), declare required config paths in metadata, and avoid printing or writing raw document content. - Verify the dynamically loaded m-flow code is from a trusted source before allowing the skill to import it. - If you cannot confirm these changes, consider the skill suspicious and avoid granting it access to your real data or environment.

Type: OpenClaw Skill Name: dual-retrieval Version: 1.0.0 The skill implements a dual retrieval pipeline but contains several indicators of poor security hygiene and environment-specific targeting. Most notably, scripts/qmd_search.py hardcodes an absolute path to a sensitive user directory (C:/Users/Administrator/.cache/qmd/index.sqlite), which is a privacy risk and a vulnerability. Additionally, the bundle includes diagnostic scripts like scripts/check_qmd_schema.py and scripts/qmd_debug.py that dump database schema and sample data to the console, which could facilitate unauthorized data inspection. While these behaviors align with the stated goal of document retrieval, the hardcoded high-privilege paths and data-dumping utilities warrant a suspicious classification.