qmd
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection in the
SKILL.mdfile to verify if the requiredqmdCLI is installed. It executesqmd statusat load time to provide the user with immediate setup feedback. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructs the user to install the
@tobilu/qmdpackage from the npm registry. This is an explicit, legitimate dependency required for the skill's primary functionality. - [COMMAND_EXECUTION]: The skill provides numerous examples and tools that involve executing the
qmdCLI andcurlcommands to manage markdown collections and perform local searches. - [INDIRECT_PROMPT_INJECTION]: As a search and retrieval tool for local markdown files, the skill presents a surface for indirect prompt injection if the ingested documents contain malicious instructions that the agent might follow upon reading them.
- Ingestion points: Markdown knowledge bases and documentation files added to collections via the
qmd collection addcommand. - Boundary markers: None identified in the provided instructions.
- Capability inventory: File system retrieval (
get,multi_get), shell command execution (Bash(qmd:*)), and local network operations (curl). - Sanitization: None identified; the skill passes content directly from the search engine to the agent context.
Audit Metadata