qmd-mcp-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on local shell commands to manage tool lifecycle and execute queries.
- It utilizes
uxc linkto create a persistent, daemon-backed session for theqmdtool. - It employs
bash -lcto initialize shell environments, including NVM and CUDA variables required for GPU-accelerated retrieval. - It performs local system checks using
command -vandqmd statusto verify tool health before execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a local knowledge base, creating a surface for potential instructions embedded within the retrieved content.
- Ingestion points: Data is pulled into the agent's context through
qmd-mcp-cli query,get, andmulti_getoperations defined inSKILL.md. - Boundary markers: The instructions do not currently specify the use of delimiters or 'ignore' instructions to wrap the retrieved knowledge base data.
- Capability inventory: The skill's operations are strictly scoped to local read-only retrieval and do not include network-egress or file-write capabilities.
- Sanitization: The skill does not implement specific sanitization or filtering logic for the indexed markdown or document content.
Audit Metadata