中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
miliger-qmd-manager
统一的QMD知识库管理技能，集成官方qmd搜索功能
This QMD knowledge management skill uses safe execFile patterns but has minor documentation gaps regarding shell command execution.
Skill Namemiliger-qmd-manager
Duration29.0s
Enginepi
✓
Safe to install
Add explicit declaration of qmd CLI execution in SKILL.md capabilities section. Otherwise, the implementation follows security best practices.

Findings 1 items

Severity Finding Location
Low
Shell execution not declared in SKILL.md Doc Mismatch
The skill uses execFile to execute the qmd CLI binary, which constitutes shell:WRITE capability. This is not mentioned in the capability declaration section of SKILL.md.
const result = await this.execCommand(this.qmdPath, args);
→ Add a 'Capabilities' or 'Security' section to SKILL.md explicitly declaring the use of execFile to invoke the qmd CLI binary.
 index.js:67
ResourceDeclaredInferredStatusEvidence
Filesystem NONE READ ✓ Aligned Only reads knowledge base via qmd CLI
Shell NONE WRITE ✗ Violation Uses execFile to execute qmd CLI commands (index.js:67)
Network NONE NONE — No network activity detected
Environment NONE NONE — Does not access environment variables
1 findings
🔗
Medium External URL 外部 URL
https://clawhub.com/skills/miliger-qmd-manager
README.md:55

File Tree

4 files · 12.9 KB · 499 lines
Markdown 2f · 287L JavaScript 1f · 179L JSON 1f · 33L
├─ 📜 index.js JavaScript 179L · 5.6 KB
├─ 📋 package.json JSON 33L · 784 B
├─ 📝 README.md Markdown 61L · 1.3 KB
└─ 📝 SKILL.md Markdown 226L · 5.2 KB

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
child_process builtin node No Standard library only
path builtin node No Standard library only

Security Positives

✓ Uses execFile instead of exec, avoiding shell injection vulnerabilities
✓ No external network requests or data exfiltration
✓ No credential harvesting or sensitive data access
✓ No base64 encoding or obfuscation detected
✓ No dependency on external packages (only uses Node.js built-ins)
✓ Predefined command whitelist: search, query, vsearch, status, get, collection
✓ User input passed as arguments (not concatenated into shell strings)