Is lifecoacher/qmd-skill-2 safe?
Yes. lifecoacher/qmd-skill-2 is safe to install. Oathe's behavioral security audit gave the qmd-skill-2 skill by lifecoacher a trust score of 87/100 with 6 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/lifecoacher/qmd-skill-2
Is lifecoacher/qmd-skill-2 safe to install?
The qmd skill is a well-structured documentation wrapper for a local markdown search CLI tool with no prompt injection, no hardcoded exfiltration paths, and clean canary integrity. The primary risk is a supply-chain concern: the install command fetches code directly from a GitHub URL without registry-level integrity verification, and the installed binary performs unaudited model downloads at runtime. The skill itself poses no direct threat to user data.
What security issues were found in lifecoacher/qmd-skill-2?
Category Scores
Findings (6)
MEDIUM Install fetches code directly from GitHub URL, bypassing package registry -28 ▶
The install command bun install -g https://github.com/tobi/qmd installs a bun/npm package directly from a GitHub repository rather than from a verified registry (e.g., npmjs.com). This means there is no registry-level signature verification, no version pinning by hash, and no immutability guarantee. A compromised or typosquatted GitHub repo could silently deliver malicious code.
LOW Runtime model auto-download introduces unaudited second-stage fetch -5 ▶
SKILL.md documents that qmd vsearch and qmd query auto-download local GGUF models on first run. The download source and integrity verification for these models are opaque from the skill audit perspective. This is a deferred code-fetch surface that occurs during normal agent operation, not at install time.
LOW openclaw-gateway establishes new persistent TCP connections post-install -12 ▶
After skill installation, the connection diff shows openclaw-gateway (pid=1083) holds two ESTABLISHED connections to 3.217.42.175:443 (AWS) and new LISTEN sockets on 127.0.0.1:18790 and 127.0.0.1:18793. These are infrastructure connections, not from the skill, but confirm the agent runtime has active external channels that could carry data.
LOW Cron scheduling examples could persist background index processes -10 ▶
SKILL.md includes cron example snippets that, if the agent follows them literally, would install system-level cron jobs running qmd update and qmd embed hourly/nightly. While benign in content, this establishes persistent scheduled execution and PATH manipulation (export PATH=$HOME/.bun/bin:$PATH) outside the agent session lifecycle.
INFO Lock file contains unrelated skill reference (metadata hygiene) -3 ▶
.clawhub/lock.json references academic-research-hub skill, indicating the developer shipped their personal workspace lock file. No security impact, but suggests the skill was not prepared from a clean environment.
INFO Sensitive file paths appeared in auditd PATH log — attributed to audit harness -3 ▶
Auditd PATH records show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials being opened at session start (1771936320) and end (1771936342). Timing analysis confirms these are audit framework pre/post baseline passes. Canary integrity check confirmed no modification or exfiltration.
Should I install lifecoacher/qmd-skill-2?
Oathe's verdict for lifecoacher/qmd-skill-2 is SAFE with a trust score of 87/100. Recommendation: Install with caution.