Manage quark-auto-save(QAS, 夸克自动转存, 夸克转存, 夸克订阅) tasks via API.

Manage quark-auto-save(QAS, 夸克自动转存, 夸克转存, 夸克订阅) tasks via API.

This skill appears to be a legitimate client for a Quark Auto-Save API, but the SKILL.md asks the agent to fetch full configuration (GET /data) and write 'Actual configuration values' — including API tokens returned by the server — into a TOOLS.md file. Before installing, consider: 1) Verify the upstream repository (https://github.com/Cp0204/quark-auto-save) and confirm what /data returns and whether it includes sensitive tokens. 2) Ask where TOOLS.md will be created (path) and avoid allowing the skill to write secrets there; if you must persist habits, store only non-sensitive metadata and redact tokens. 3) Limit QAS_TOKEN scope or use an ephemeral/revocable token. 4) Review the included scripts/qas_client.py (it uses token in URL) and run it in an isolated environment/container if possible. 5) Be cautious about using the delete or run endpoints — they can remove or execute tasks; require user confirmation. If you cannot confirm safe handling of TOOLS.md and token persistence, treat this skill as untrusted.

Type: OpenClaw Skill Name: quark-auto-save Version: 0.8.6 The quark-auto-save skill is a legitimate integration for managing Quark cloud drive automation tasks. The provided Python script (scripts/qas_client.py) is a standard API wrapper using urllib, and the instructions in SKILL.md guide the AI agent on how to automate task creation and habit analysis. While the underlying service's API requires passing the authentication token in the URL query string (a minor security anti-pattern), the skill itself demonstrates no malicious intent, such as data exfiltration to third parties or unauthorized command execution. All behaviors, including the instruction for the agent to record user directory patterns in TOOLS.md, are aligned with the stated purpose of automating media file organization.