skills/ssiumha/dots/qmd/Gen Agent Trust Hub

qmd

Fail

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The installation instructions in REFERENCE.md recommend running bun install -g https://github.com/tobi/qmd, which downloads and installs a global CLI tool from an untrusted third-party repository.
  • [EXTERNAL_DOWNLOADS]: The tool is designed to automatically download approximately 3.1GB of machine learning models from remote sources at runtime, including embedding and re-ranking models.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands such as qmd collection add and qmd update --pull. These commands interact with local directories (e.g., ~/notes) and perform network operations like git pull to sync remote content into the local index.
  • [COMMAND_EXECUTION]: The agent is instructed to use various search commands (qmd search, qmd vsearch, qmd query) which execute local binaries and read document contents directly from the user's file system.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 13, 2026, 05:22 AM