Quark Netdisk

Automate Quark Drive (夸克网盘): QR-code login, list/search, upload, create share links (expiry/passcode), and save others' shared links into your drive. Use whe...

What to consider before installing: - Function: The skill appears to do what it says (QR login, browse/upload/share, save others’ shares) and enforces configured allowlists — set remoteAllowlist/localAllowlist in references/config.json before use. - Sensitive files: The skill will create and persist session_api.json, cookies.json, login_token.json and qr_code.png under the skill's references/ folder. These files contain authentication cookies/tokens; keep them private, restrict filesystem permissions, and rotate credentials if they are ever exposed. - Proxy/monitoring: The code disables using environment proxy variables (trust_env=False). That causes direct HTTPS connections to Quark endpoints and can bypass host proxies, auditing, or egress filters — if your environment requires traffic to go via a proxy for inspection, do not run this skill without modifying the code to honor proxies. - Undeclared env var: QUARK_COOKIE can override cookies if set in the environment. Treat any environment-based overrides as credential-bearing and avoid setting them in shared CI or multi-tenant hosts. - Run scope: Prefer running this skill in a controlled environment (personal machine, isolated container) and inspect the references/ folder after login. Confirm destructive operations require explicit confirmation and the allowlists are correct before issuing any delete/move commands. - If you need high assurance: review the code in scripts/* yourself (or ask an auditor) and consider changing trust_env to True or otherwise enforcing host proxy policies, and ensure proper permissions on the skill directory. If anything is unclear, treat the skill as untrusted until further review.

Type: OpenClaw Skill Name: quark-netdisk Version: 1.0.0 The quark-netdisk skill is a legitimate automation tool for managing Quark Drive accounts. It features well-defined security constraints, including mandatory local and remote path allowlists (enforced in scripts/quark_drive.py) and a soft-delete mechanism that moves files to a trash folder instead of permanent deletion. The SKILL.md instructions specifically guide the AI agent to respect privacy, avoid leaking session data, and require user confirmation for destructive actions. The code uses standard libraries for QR generation and Aliyun OSS uploads, with no evidence of data exfiltration, malicious execution, or obfuscation.