The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @tobilu/qmd package from the npm registry. This is an external dependency that provides the core indexing and search functionality.
[COMMAND_EXECUTION]: The record.sh script executes several shell commands, including git to extract project names from repository metadata (git remote get-url origin), mkdir for directory structure management, and the qmd CLI for knowledge operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data that is stored and later retrieved by the AI agent, creating a surface for potential indirect injection.
Ingestion points: External data is ingested through arguments to the record.sh script (e.g., topic descriptions, issue notes, and general text).
Boundary markers: The generated markdown files do not include specific delimiters or warning instructions to isolate the recorded data from the agent's processing context.
Capability inventory: The skill can perform file system writes and directory creation within the user's home directory, and it can execute the qmd tool for searching.
Sanitization: The script implements a slugify function and a validate_safe_path function to sanitize filenames and prevent path traversal attacks, although the content of the notes is written directly to files without escaping.

qmd-knowledge