qmd-sessions
Converts Claude Code session transcripts into searchable markdown files for efficient indexing and retrieval.
Install this skill
Security score
The qmd-sessions skill was audited on Jun 5, 2026 and we found 26 security issues across 4 threat categories, including 1 critical. Review the findings below before installing.
Categories Tested
Security Issues
Piping content to bash shell
| 111 | - If not: "Bun is not installed. qmd requires Bun as its runtime. Install it with `curl -fsSL https://bun.sh/install | bash`? This installs to `~/.bun/bin/bun`." (Note: curl is not in the skill's pre- |
Curl to non-GitHub URL
| 111 | - If not: "Bun is not installed. qmd requires Bun as its runtime. Install it with `curl -fsSL https://bun.sh/install | bash`? This installs to `~/.bun/bin/bun`." (Note: curl is not in the skill's pre- |
Access to hidden dotfiles in home directory
| 13 | node ~/.claude/skills/qmd-sessions/refresh.js |
Access to hidden dotfiles in home directory
| 23 | - Reads all session JSONL files from `~/.claude/projects/` |
Access to hidden dotfiles in home directory
| 56 | 1. Check `~/.claude/skills/qmd-sessions/config.json` for a saved `outputDir`. If found, show it: |
Access to hidden dotfiles in home directory
| 61 | Once confirmed, check if the directory is already saved in `~/.claude/skills/qmd-sessions/config.json`: |
Access to hidden dotfiles in home directory
| 70 | find ~/.claude/projects -maxdepth 2 -name '*.jsonl' -not -name '*compact*' | wc -l |
Access to hidden dotfiles in home directory
| 71 | find ~/.claude/projects -path '*/subagents/*.jsonl' -not -name '*compact*' | wc -l |
Access to hidden dotfiles in home directory
| 72 | ls -d ~/.claude/projects/*/ 2>/dev/null | wc -l |
Access to hidden dotfiles in home directory
| 80 | node ~/.claude/skills/qmd-sessions/convert-sessions.js <output-directory> |
Access to hidden dotfiles in home directory
| 108 | Check: `which bun` or `~/.bun/bin/bun --version` |
Access to hidden dotfiles in home directory
| 111 | - If not: "Bun is not installed. qmd requires Bun as its runtime. Install it with `curl -fsSL https://bun.sh/install | bash`? This installs to `~/.bun/bin/bun`." (Note: curl is not in the skill's pre- |
Access to hidden dotfiles in home directory
| 120 | Check if Node ≥22 is available via nvm: `ls ~/.nvm/versions/node/ | grep -E '^v2[2-9]'` |
Access to hidden dotfiles in home directory
| 132 | Then check the exact version installed: `ls ~/.nvm/versions/node/ | grep -E '^v2[2-9]' | tail -1` |
Access to hidden dotfiles in home directory
| 165 | > "`qmd update` will scan all collection files into the index. Then `qmd embed` will generate vector embeddings. On first embed, this downloads the embedding model (~300MB) to `~/.cache/qmd/models/`. |
Access to hidden dotfiles in home directory
| 173 | Read `~/.claude.json` and check for `mcpServers.qmd`. |
Access to hidden dotfiles in home directory
| 174 | - If configured: "qmd MCP server already configured in `~/.claude.json`." |
Access to hidden dotfiles in home directory
| 176 | - If not: "I'd like to add qmd as an MCP server so Claude Code can search your sessions. This adds to `~/.claude.json`:" |
Access to hidden dotfiles in home directory
| 183 | Read `~/.claude/settings.json` and check for PreCompact and SessionEnd hooks that run `hook.js`. |
Access to hidden dotfiles in home directory
| 192 | - If any missing: "I'd like to add hooks so sessions are automatically converted and indexed. This adds to `~/.claude/settings.json`:" |
Access to hidden dotfiles in home directory
| 196 | "PreCompact": [{ "hooks": [{ "type": "command", "command": "node ~/.claude/skills/qmd-sessions/hook.js" }] }], |
Access to hidden dotfiles in home directory
| 197 | "SessionEnd": [{ "hooks": [{ "type": "command", "command": "node ~/.claude/skills/qmd-sessions/hook.js" }] }] |
Access to hidden dotfiles in home directory
| 204 | Read `~/.claude/CLAUDE.md` and check for a "Session Search" section. |
Access to hidden dotfiles in home directory
| 211 | Read `~/.claude/skills/qmd-sessions/config.json` and check for a `loadContextOnStartup` key. |
Access to hidden dotfiles in home directory
| 219 | - If not: "I'd like to add qmd search guidance to `~/.claude/CLAUDE.md` so Claude uses qmd for session search. This appends:" |
External URL reference
| 111 | - If not: "Bun is not installed. qmd requires Bun as its runtime. Install it with `curl -fsSL https://bun.sh/install | bash`? This installs to `~/.bun/bin/bun`." (Note: curl is not in the skill's pre- |