Agent skill · Audited from source
Qmd
skill · pedronauck/skillsLicence not declaredAudited 16 Oct 2026 · source 118e61cf1c61
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 118e61cf1c61 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Search local markdown knowledge bases, notes, docs, and wikis with QMD. Use when users ask to find notes, retrieve documents, inspect a wiki, answer from indexed markdown, or set up QMD access.
Cite
Cite this page
ModelsAtlas. “Qmd (pedronauck/skills)”. Retrieved 16 Oct 2026. https://modelsatlas.com/skills/pedronauck/qmd
3 skills are called “Qmd”. You are viewing pedronauck/skills.
- pedronauck/skills★ 637✓SAFE
- tobi/qmd★ 31k✓SAFE
- LeoYeAI/openclaw-master-skills★ 2.2k✓SAFE
Trust audit
Audit 0.4.1 · source read 16 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha 118e61cf1c61 · 16 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherpedronauck GitHub userOwner of the repository this skill is read from
- Source folderpedronauck/skills/skills/curated/qmdThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict118e61cf1c61A new audit runs when the source changes
- Repository statusNot archivedLast push 31 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Search local markdown knowledge bases, notes, docs, and wikis with QMD. Use when users ask to find notes, retrieve documents, inspect a wiki, answer from indexed markdown, or set up QMD access.
---
name: qmd
description: Search local markdown knowledge bases, notes, docs, and wikis with QMD. Use when users ask to find notes, retrieve documents, inspect a wiki, answer from indexed markdown, or set up QMD access.
license: MIT
compatibility: Requires qmd CLI or MCP server. Install via `npm install -g @tobilu/qmd`.
metadata:
author: tobi
version: "2.2.0"
allowed-tools: Bash(qmd:*), mcp__qmd__*
---
# QMD - Query Markdown Documents
## How search works
QMD searches local markdown collections: notes, docs, wikis, transcripts, and
project knowledge bases. Use it before web search when the answer may already be
in indexed local files.
The workflow is always:
1. Search for candidate documents.
2. Retrieve the full source with `qmd get` or `qmd multi-get`.
3. Answer from retrieved text, citing paths or docids.
Do not answer from snippets alone when the user needs facts, decisions, quotes,
or nuance. Snippets are only leads.
Typical loop:
```bash
qmd search "merchant reality support interviews" -n 5
# leads: #abc123 concepts/customer-proximity.md; #def432 sources/merchant-call.md
qmd multi-get "#abc123,#def432" --format md
```
**Default to structured `qmd query` with `intent:`, `lex:`, `vec:`, and `hyde:`
fields that you write yourself.** You are a better query expander than the
built-in model: you know the user's actual goal, the domain vocabulary, and the
nearby-but-wrong concepts to avoid. Do not just paste the user's words into
`qmd query "..."` and hope the expansion model guesses right — supply the
`intent:` and craft the lexical and semantic terms deliberately (see
[Pick the right search mode](#pick-the-right-search-mode)).
When reporting what you retrieved, a compact note is enough; do not paste whole
files unless needed:
```text
Retrieved:
- #abc123 concepts/customer-proximity.md
- #def432 sources/merchant-call.md
```
## Pick the right search mode
Use **BM25 lexical search** when you know exact words, titles, names, code
symbols, or rare phrases:
```bash
qmd search "cockpit OKR Goodhart" -n 10
qmd search '"AI Before Headcount"' -c concepts -n 5
```
Use **`qmd query` with structured fields** when the user describes an idea
indirectly, uses different wording than the source, or needs conceptual recall.
**This is the default mode — write the fields yourself rather than leaning on
query expansion.** Combine exact anchors with semantic recall:
```bash
qmd query $'intent: Find the concept note about metrics as instruments without letting OKRs replace judgment.\nlex: cockpit instruments OKR Goodhart metrics judgment\nvec: data informed not metric driven product judgment\nhyde: A concept note says metrics are useful like cockpit instruments, but leaders should remain data-informed rather than metric-driven because OKRs and dashboards can Goodhart product judgment.'
```
Structured query fields (you author each one — do not delegate this to the
expansion model):
- `intent:` states what you are trying to find **and what to avoid**. Always
supply this. It steers ranking away from nearby-but-wrong concepts.
- `lex:` exact terms, aliases, titles, code symbols, and rare words you expect
in the source. This is your own keyword expansion.
- `vec:` paraphrases the idea in natural language, in source-like wording.
- `hyde:` describes the document or answer that would satisfy the request.
You do not need all four every time, but you should almost always write at least
`intent:` plus one of `lex:`/`vec:`. A bare `qmd query "the user's sentence"`
throws away the context only you have and relies on the built-in expander to
reconstruct it — prefer the structured form.
If you genuinely have nothing to expand (a single rare token, a verbatim phrase),
that is a job for `qmd search`, not bare `qmd query`:
```bash
qmd query --format json --explain $'intent: ...\nlex: ...\nvec: ...' # inspect ranking
```
If `qmd query` is slow or model/GPU setup fails, fall back to `qmd search` with
better lexical terms.
## Retrieve sources
Search results include docids like `#abc123` and `qmd://...` paths. Fetch them:
```bash
qmd get "#abc123"
qmd get qmd://concepts/ai-before-headcount.md
qmd multi-get "#abc123,#def432" --format md
qmd multi-get 'concepts/{ai-before-headcount.md,data-informed-not-metric-driven.md}' --format md
qmd multi-get 'sources/podcast-2025-*.md' -l 80
```
Use `multi-get` when comparing several hits or gathering context across pages.
### Output is line-numbered and carries the docid — cite both
`get` and `multi-get` are **line-numbered by default** and always print the
document's `#docid` and `qmd://` path. So `get` output looks like:
```text
qmd://concepts/note.md #abc123
---
1: # Metrics as instruments
2:
3: Treat dashboards like cockpit instruments...
```
Cite the docid and exact line numbers in your answer, and use the numbers to ask
for the next slice. Pass `--no-line-numbers` only when you need raw content to
copy verbatim (e.g. reproducing a code block).
When you need to open or edit the underlying file (e.g. hand a path to `Read`,
`Edit`, or an editor), add `--full-path`. It replaces the `qmd://` URL + docid
header with the document's on-disk path, falling back to the canonical header if
the file no longer exists on disk:
```text
$ qmd get "#abc123" --full-path
/Users/you/notes/concepts/note.md
---
1: # Metrics as instruments
```
`--full-path` works the same way on `qmd search` and `qmd query`: result paths
become the file's on-disk path — `./`-prefixed relative path when the file is
inside `$PWD`, absolute realpath otherwise — and the per-result `#docid` is
dropped because the path is the identifier. The leading `./` is intentional so
the output is unambiguously a filesystem path and cannot be mistaken for a bare
collection-relative string. Default search/query output still uses `qmd://`
URIs; only opt into `--full-path` when you specifically need a path you can hand
to a non-QMD tool.
### Read line ranges with the `:from:count` suffix — never pipe thExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 118e61c
npm install -g @tobilu/qmd
git clone https://github.com/pedronauck/skills git -C skills checkout 118e61cf1c61
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 118e61cf1c61 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Claude Desktop | Mentioned in its text, not tested | Skills for Claude Desktop · About Claude Desktop |
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
118e61cf1c61
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/pedronauck/qmd/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when creating new skills, editing existing skills, or verifying skills work before deployment
mattpocock/skills
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
mattpocock/skills
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
Add this badge to your README
[](https://modelsatlas.com/skills/pedronauck/qmd/)
<a href="https://modelsatlas.com/skills/pedronauck/qmd/"><img src="https://modelsatlas.com/skills/pedronauck/qmd/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about Qmd
What does the Qmd skill do?
Is Qmd safe to install?
What can Qmd access on my machine?
Which assistants does Qmd work with?
How current is this page?
Sources
- github.com/pedronauck/skills/tree/main/skills/curated/qmd — the audited source at commit 118e61cf1c61 and every finding aboveObserved · 16 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Qmd skill do?
- Is Qmd safe to install?
- What can Qmd access on my machine?