The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the shell command qmd query "<user_query>" using input provided by the user. Because the input is interpolated into a double-quoted string in a shell environment, an attacker can use command substitution (e.g., $(...)) or escape the quotes (e.g., " ; command #) to execute arbitrary code on the host system.
[EXTERNAL_DOWNLOADS]: The skill directs the user to globally install the qmd package via npm or bun. This package is not from a verified or trusted vendor, and the skill explicitly states that the tool will download approximately 1.5GB of external models upon its first run, which represents an unverified remote data acquisition.
[INDIRECT_PROMPT_INJECTION]: The skill performs semantic search over a user's knowledge base (notes, ADRs, tasks). If these files contain malicious instructions, they could influence the agent's behavior when the results are parsed and displayed, as the skill lacks boundary markers or sanitization logic.
Ingestion points: Search result excerpts and YAML metadata records loaded from the .claude/data/ directory.
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the output formatting.
Capability inventory: The skill possesses shell execution capabilities (qmd) and file system access (reading YAML records).
Sanitization: No sanitization or validation is performed on the ingested content before it is processed by the agent.

secondbrain-search