The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses high-pressure language ('You MUST use the exact command', 'Do NOT optimize', 'hardcoded and immutable') to override agent behavior and enforce specific execution patterns. Additionally, there is a discrepancy between the whitelist of 8 applications in the instructions and the underlying config.toml, which includes additional processes like 'browser' and 'QClaw'.
[EXTERNAL_DOWNLOADS]: The run_kc.ps1 script automatically downloads and installs the Visual C++ Redistributable from Microsoft's official domain (aka.ms) and the WebView2 Runtime using winget or Microsoft's developer site.
[COMMAND_EXECUTION]: The skill executes a local binary kc.exe via PowerShell, passing user-provided task descriptions as command-line arguments. It requires the agent to set a long timeout (600 seconds) for execution.
[CREDENTIALS_UNSAFE]: The PowerShell wrapper script reads sensitive API keys and base URLs from the user's local ~/.qclaw/openclaw.json file and writes them in plain text to the %LOCALAPPDATA%\kc\config.toml configuration file.

kc-gui