qmd
Fail
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions in
REFERENCE.mdrecommend runningbun install -g https://github.com/tobi/qmd, which downloads and installs a global CLI tool from an untrusted third-party repository. - [EXTERNAL_DOWNLOADS]: The tool is designed to automatically download approximately 3.1GB of machine learning models from remote sources at runtime, including embedding and re-ranking models.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands such as
qmd collection addandqmd update --pull. These commands interact with local directories (e.g.,~/notes) and perform network operations likegit pullto sync remote content into the local index. - [COMMAND_EXECUTION]: The agent is instructed to use various search commands (
qmd search,qmd vsearch,qmd query) which execute local binaries and read document contents directly from the user's file system.
Recommendations
- AI detected serious security threats
Audit Metadata