Is emcmillan80/qmd-markdown-search safe?
Yes. emcmillan80/qmd-markdown-search is safe to install. Oathe's behavioral security audit gave the qmd-markdown-search skill by emcmillan80 a trust score of 87/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/emcmillan80/qmd-markdown-search
Is emcmillan80/qmd-markdown-search safe to install?
This skill provides documentation for qmd, a legitimate local markdown search tool. While it requires installation of external code and accesses user files, the functionality is transparent and appropriate for its stated purpose. No malicious behavior was detected during installation monitoring.
What security issues were found in emcmillan80/qmd-markdown-search?
Category Scores
Findings (4)
MEDIUM External Code Installation -25 ▶
The skill instructs the agent to install external code from GitHub via 'bun install -g https://github.com/tobi/qmd'. While this appears to be a legitimate markdown search tool, it introduces supply chain risk.
LOW External URL References -10 ▶
The skill contains references to external GitHub repositories. While legitimate for documentation purposes, external URLs can potentially be vectors for prompt injection or redirection attacks.
LOW File System Access -10 ▶
The tool will access and index user's markdown files as configured. While this is the intended functionality, it could potentially access sensitive information if misconfigured.
INFO Shell Command Instructions -5 ▶
The skill provides shell command examples that the agent may execute. These appear legitimate but increase the attack surface.
Should I install emcmillan80/qmd-markdown-search?
Oathe's verdict for emcmillan80/qmd-markdown-search is SAFE with a trust score of 87/100. Recommendation: Install with caution.