Quark Drive automation (夸克网盘)

Hard constraints (must follow)

Remote allowlist: Only operate under remote path prefix(es) configured in references/config.json (or fallback references/config.example.json). Default allowlist should be /OpenClaw/**.
Local allowlist: Only read/upload from local path prefix(es) configured. Do not read arbitrary local paths.
Destructive operations need confirmation by default: delete / move / rename / copy / purge.
If Quark triggers captcha / risk control, stop and ask the user to take over in a real browser.

Treat these files as sensitive (never commit, never paste their contents):
- references/session_api.json, references/cookies.json, references/login_token.json, references/qr_code.png
- (If enabled) references/index.json (may contain private filenames/paths)
Do not print cookies, auth headers, or full raw responses unless user explicitly requests debug.
When sharing the skill, keep examples generic (no usernames, absolute paths, chat_id, or personal tokens).