qmd-expert
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
evalto execute shell commands with variables (e.g.,eval "qmd $q ..."). This pattern is susceptible to command injection if the query variable$q, which the agent generates, contains shell metacharacters like semicolons or backticks. - [PROMPT_INJECTION]: The skill facilitates the ingestion of data from an external knowledge base into the agent's working context, creating a surface for indirect prompt injection (Category 8).
- Ingestion points: External content enters the context via the
qmdsearch tool andqmd getcommands inSKILL.md. - Boundary markers: The workflow does not include instructions to wrap external content in delimiters or use specific system instructions to ignore embedded commands.
- Capability inventory: The workflow utilizes shell operations (
eval,rm,sed,awk) and theqmdCLI as documented inSKILL.md. - Sanitization: There is no evidence of content sanitization or validation performed on the data retrieved from the knowledge base.
Audit Metadata