The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill executes the shell command qmd query "<user_query>" --json --limit=<limit>. The <user_query> variable is directly interpolated from user input into a shell string within double quotes. An attacker providing a query like hello" ; id ; # could achieve arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS] (MEDIUM): The skill requires the installation of an external, unverifiable package qmd via npm or bun. This package is not from a trusted source and is installed globally (-g), which is a security risk if the package or its dependencies are malicious.
[REMOTE_CODE_EXECUTION] (HIGH): Combined with the command injection vulnerability, this allows for remote execution of arbitrary code should the agent process a malicious search query or untrusted metadata from the 'secondbrain' files.
[INDIRECT_PROMPT_INJECTION] (MEDIUM): The skill ingests data from local project files (notes, ADRs, tasks). If these files contain malicious instructions, they could influence the agent's behavior when it 'Enriches with Metadata' or 'Formats Output', especially if the agent treats the content of these files as instructions rather than data.
[PRIVILEGE_ESCALATION] (MEDIUM): Recommending global installation of npm packages (npm install -g) often prompts users for sudo privileges, increasing the potential impact of a malicious package.

secondbrain-search