What Are QClaw Skills? A Complete Guide to Installing, Enabling, and Managing Permissions

You installed QClaw, scanned the QR code, linked WeChat — and then hit the “now what” moment. It can organize files, send email, check web pages, but none of that appears out of thin air. There’s a system called Skills behind it. Understand how Skills install, switch on, and handle permissions, and you’ve basically got half of QClaw figured out.

This walks through it in order — what they are, install, enable, permissions — assuming you’ve just set up the desktop app and haven’t touched a single skill yet.

What a Skill actually is

Think “plugin” and you’re most of the way there. QClaw itself receives the command you send through WeChat, parses the intent, and runs it on your computer. What it actually knows how to do is largely determined by which Skills you’ve installed.

Officially, Skills are described as extension capability modules. You install ready-made ones from the Skills marketplace — common categories include GitHub integration, schedule management, and email automation — and if nothing in the marketplace fits, you can have QClaw write a new Skill for you.

QClaw without any Skills isn’t useless; basic file operations and draft generation are built in. But the moment you want to wire up a specific workflow — pushing code to GitHub, dropping a meeting into your calendar — the matching Skill is the piece that makes the command land.

Installing from the Skills marketplace

Installation happens on the desktop, not your phone. Roughly:

1. Open QClaw on your computer and go to the Skills section, split into “Installed” and “Marketplace.”
2. Browse the marketplace by category or keyword for the capability you want — search email-related skills if you’re after inbox cleanup.
3. Open a skill’s detail page and read what it claims to do, which external services it connects to, and which permissions it asks for.
4. Confirm, then install. Some skills prompt you for a one-time setup right after.

Here’s the step people skip: read the detail page before installing. A GitHub integration skill will almost certainly want repository access; a calendar skill may want to connect your calendar account. Those are prerequisites for it to work — and they also mean you’re handing over a slice of access.

For any skill that touches third-party services, the authorization scope follows that service’s and the skill’s current terms. Before connecting a work mailbox or code repository, make sure you’re actually allowed to — don’t grant access casually if you’re unclear on your organization’s compliance rules.

Enable, configure, disable

Installed isn’t the same as running. Most skills land in a pending or needs-setup state, so two things follow:

Finish configuration. An email skill needs a mailbox connected; a calendar skill needs a calendar picked. Config data generally lives locally, but exactly where it’s stored and how it’s encrypted follows the in-app notes.

Check the enabled state. In the “Installed” list, each Skill has its own switch. On means it responds to related commands; off means silence. When you temporarily don’t need one — or worry a skill has too much reach — flipping it off beats uninstalling. The config stays put, ready when you are.

My own habit: keep the two or three I use daily on, install the occasional ones but leave them off until needed. The more skills are active, the wider the capability surface QClaw weighs when parsing a command, and you’ll occasionally get a “which skill should handle this” ambiguity. Lean and focused usually beats crowded.

A few permission boundaries

Permissions are the part of Skills to take seriously, because they tie directly to the safety of your files, accounts, and data.

• Grant the minimum that works. A skill that only needs to read your calendar has no business holding write and delete rights. When scope is selectable, pick the smallest set that does the job.
• Review your grants periodically. Every so often, look over your installed skills and their permissions, disable or uninstall what you no longer use, and pull back the access along with it.
• Keep a human in the loop for sensitive actions. Deleting files, sending email in bulk, changing repositories — keep these in a mode that needs your confirmation rather than fully automatic.
• Don’t hand high permissions to skills from unknown sources. A skill with murky origins or vague descriptions deserves suspicion no matter how tempting its features, especially if it wants account access or broad file-system reach.

One more note on data flow: QClaw is designed to run on your own computer, with local files and records under your control. But once a Skill connects to an external service, data may flow to that provider. Where that line sits depends on what you install and what you authorize — worth thinking through before you click.

Where to start after install

Don’t make your first skill a complicated one. Pick a small daily annoyance — automatic desktop file sorting, or email draft generation. Install one, configure it, live with it for a few days, learn its quirks, then take on the heavier stuff that needs external authorization.

Getting comfortable with how you phrase commands helps too; even a powerful skill runs off-target when the command is vague.

Further reading: to push your installed skills further, see the QClaw task automation deep dive; unsure how to phrase commands, browse the usage guides; and if you haven’t installed the client yet, download QClaw is step one.