secondbrain-search-init

SUSPICIOUS. The skill’s purpose and local file/command footprint are mostly coherent for setting up semantic search, and there is no clear credential theft or exfiltration path. However, the install instructions are internally inconsistent with the verified upstream package name (`@tobilu/qmd` vs bare `qmd`), creating meaningful supply-chain ambiguity; combined with an unverifiable hook script not included in the skill, this raises the overall risk to medium.