Qmd

OpenClaw analysis

This skill is a straightforward local file indexing/search helper, with a real but disclosed install supply-chain risk from an unpinned GitHub dependency.

Confidence: high

VirusTotal

Type: OpenClaw Skill Name: qmd Version: 1.0.0 The skill bundle defines a local search/indexing CLI tool. The `SKILL.md` provides installation instructions for `qmd` from a seemingly legitimate GitHub repository (`https://github.com/tobi/qmd`) and outlines local CLI usage. There is no evidence of data exfiltration, malicious execution instructions, persistence mechanisms, prompt injection attempts, or obfuscation. All described operations are local and aligned with the stated purpose of a search/indexing tool.