The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's installation metadata specifies downloading a Node.js package from a personal GitHub repository (https://github.com/tobi/qmd) rather than an official organization or verified service repository.
[REMOTE_CODE_EXECUTION]: The setup process involves downloading and installing external code that is subsequently executed as a CLI tool. This represents a supply chain risk if the third-party repository is compromised.
[COMMAND_EXECUTION]: The skill relies on executing shell commands using the qmd CLI to manage collections, update indices, and perform document searches.
[DATA_EXFILTRATION]: The skill's primary function is to read and index local files, creating a data exposure surface. While the documentation includes instructions to prevent network transmission, the underlying capability to access sensitive local content remains present.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it indexes and displays content from local files that may contain malicious instructions.
Ingestion points: Local file content enters the agent's context through the qmd search, qmd query, and qmd get commands specified in SKILL.md.
Boundary markers: The skill does not implement any delimiters or "ignore instructions" markers to isolate indexed file content from the agent's control logic.
Capability inventory: The agent can execute shell commands via the qmd tool and has the potential to perform broader system operations if prompted.
Sanitization: No automated sanitization or filtering of file content is performed to detect or neutralize embedded instructions before the data is processed by the agent.
[CREDENTIALS_UNSAFE]: The SAFETY.md file contains a mock hardcoded credential (ADMIN_PASSWORD=ChangeMeNow123) within its demonstration examples. While used for safety evaluation purposes, the presence of such patterns in the skill files is a technical finding.

qmd-hardened