Qmd

Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections.

This skill is internally consistent for local markdown search, but consider the following before installing: 1) qmd will index whatever directories you add — avoid indexing sensitive directories or configure masks to exclude secrets. 2) The recommended install uses Bun to fetch code from the project's GitHub repo and qmd may auto-download GGUF models into ~/.cache/qmd/models; ensure you trust the upstream project and have disk/network capacity. 3) If you schedule automatic updates/embeddings (cron or agent scheduler), those jobs will run qmd commands with the PATH you provide — be careful what PATH and environment you export in scheduled contexts. If you want extra assurance, install qmd manually from the official repo, verify checksums/releases, and test indexing on a small, non-sensitive subset of files first.

Type: OpenClaw Skill Name: qmd-skill-3 Version: 0.1.0 The skill is classified as suspicious due to the `qmd get "path/to/file.md"` command described in `SKILL.md`. While intended for retrieving indexed markdown documents, this command grants the AI agent the capability to read the full content of arbitrary local files. This presents a significant data exposure vulnerability if the agent is susceptible to prompt injection or misdirection, potentially allowing it to access sensitive files outside its intended scope (e.g., configuration files, private keys). There is no explicit malicious intent in the provided instructions, but the exposed capability is high-risk.