Agent skill · Audited from source
qmd
skill · levineam/qmd-skillLicence not declaredAudited 20 Oct 2026 · source f574c50e6f9f
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit f574c50e6f9f and found no filesystem, network or shell access and no hard-coded secrets. What it does: Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections.
Cite
Cite this page
ModelsAtlas. “qmd (levineam/qmd-skill)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/levineam/qmd
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass, no license.
Findings (1)
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
Audit 0.4.1 · source sha f574c50e6f9f · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherlevineam GitHub userOwner of the repository this skill is read from
- Source folderlevineam/qmd-skillThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdictf574c50e6f9fA new audit runs when the source changes
- Repository statusNot archivedLast push 236 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections.
---
name: qmd
description: Local hybrid search for markdown notes and docs. Use when searching notes, finding related content, or retrieving documents from indexed collections.
homepage: https://github.com/tobi/qmd
metadata: {"clawdbot":{"emoji":"🔍","os":["darwin","linux"],"requires":{"bins":["bun","qmd"]},"install":[{"id":"bun-qmd","kind":"shell","command":"bun install -g https://github.com/tobi/qmd","bins":["qmd"],"label":"Install qmd via Bun"}]}}
---
# qmd - Quick Markdown Search
Local search engine for Markdown notes, docs, and knowledge bases. Index once, search fast.
## When to use (trigger phrases)
- "search my notes / docs / knowledge base"
- "find related notes"
- "retrieve a markdown document from my collection"
- "search local markdown files"
## Default behavior (important)
- Prefer `qmd search` (BM25). It's typically instant and should be the default.
- Use `qmd vsearch` only when keyword search fails and you need semantic similarity (can be very slow on a cold start).
- Avoid `qmd query` unless the user explicitly wants the highest quality hybrid results and can tolerate long runtimes/timeouts.
## Prerequisites
- Bun >= 1.0.0
- macOS: `brew install sqlite` (SQLite extensions)
- Ensure PATH includes: `$HOME/.bun/bin`
Install Bun (macOS): `brew install oven-sh/bun/bun`
## Install
`bun install -g https://github.com/tobi/qmd`
## Setup
```bash
qmd collection add /path/to/notes --name notes --mask "**/*.md"
qmd context add qmd://notes "Description of this collection" # optional
qmd embed # one-time to enable vector + hybrid search
```
## What it indexes
- Intended for Markdown collections (commonly `**/*.md`).
- In our testing, "messy" Markdown is fine: chunking is content-based (roughly a few hundred tokens per chunk), not strict heading/structure based.
- Not a replacement for code search; use code search tools for repositories/source trees.
## Search modes
- `qmd search` (default): fast keyword match (BM25)
- `qmd vsearch` (last resort): semantic similarity (vector). Often slow due to local LLM work before the vector lookup.
- `qmd query` (generally skip): hybrid search + LLM reranking. Often slower than `vsearch` and may timeout.
## Performance notes
- `qmd search` is typically instant.
- `qmd vsearch` can be ~1 minute on some machines because query expansion may load a local model (e.g., Qwen3-1.7B) into memory per run; the vector lookup itself is usually fast.
- `qmd query` adds LLM reranking on top of `vsearch`, so it can be even slower and less reliable for interactive use.
- If you need repeated semantic searches, consider keeping the process/model warm (e.g., a long-lived qmd/MCP server mode if available in your setup) rather than invoking a cold-start LLM each time.
## Common commands
```bash
qmd search "query" # default
qmd vsearch "query"
qmd query "query"
qmd search "query" -c notes # Search specific collection
qmd search "query" -n 10 # More results
qmd search "query" --json # JSON output
qmd search "query" --all --files --min-score 0.3
```
## Useful options
- `-n <num>`: number of results
- `-c, --collection <name>`: restrict to a collection
- `--all --min-score <num>`: return all matches above a threshold
- `--json` / `--files`: agent-friendly output formats
- `--full`: return full document content
## Retrieve
```bash
qmd get "path/to/file.md" # Full document
qmd get "#docid" # By ID from search results
qmd multi-get "journals/2025-05*.md"
qmd multi-get "doc1.md, doc2.md, #abc123" --json
```
## Maintenance
```bash
qmd status # Index health
qmd update # Re-index changed files
qmd embed # Update embeddings
```
## Keeping the index fresh
Automate indexing so results stay current as you add/edit notes.
- For keyword search (`qmd search`), `qmd update` is usually enough (fast).
- If you rely on semantic/hybrid search (`vsearch`/`query`), you may also want `qmd embed`, but it can be slow.
Example schedules (cron):
```bash
# Hourly incremental updates (keeps BM25 fresh):
0 * * * * export PATH="$HOME/.bun/bin:$PATH" && qmd update
# Optional: nightly embedding refresh (can be slow):
0 5 * * * export PATH="$HOME/.bun/bin:$PATH" && qmd embed
```
If your Clawdbot/agent environment supports a built-in scheduler, you can run the same commands there instead of system cron.
## Models and cache
- Uses local GGUF models; first run auto-downloads them.
- Default cache: `~/.cache/qmd/models/` (override with `XDG_CACHE_HOME`).
## Relationship to Clawdbot memory search
- `qmd` searches *your local files* (notes/docs) that you explicitly index into collections.
- Clawdbot's `memory_search` searches *agent memory* (saved facts/context from prior interactions).
- Use both: `memory_search` for "what did we decide/learn before?", `qmd` for "what's in my notes/docs on disk?".Excerpt, first 4,915 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit f574c50
git clone https://github.com/levineam/qmd-skill git -C qmd-skill checkout f574c50e6f9f
The author documents no install command, so this uses the repository directly. Our verdict covers commit f574c50e6f9f only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
f574c50e6f9f
Similar skills
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Questions about qmd
Is qmd safe to install?
What can qmd access on my machine?
Which assistants does qmd work with?
How current is this page?
Sources
- github.com/levineam/qmd-skill — the audited source at commit f574c50e6f9f and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- Is qmd safe to install?
- What can qmd access on my machine?
- Which assistants does qmd work with?