Tencent Cloud Log Service

Query and analyze Tencent Cloud CLS logs

Security Scan

The skill's instructions and required Tencent Cloud credentials are coherent for querying CLS logs, but inconsistencies (registry metadata vs SKILL.md), a generic homepage, and a third‑party Homebrew tap for installation raise concerns you should address before installing.

Purpose & Capability

The skill's stated purpose (query/analyze Tencent CLS logs) matches the SKILL.md: it calls a CLI named clscli and requires Tencent Cloud API credentials. However the registry metadata at the top-level claims no required binaries or env vars while SKILL.md declares clscli and TENCENTCLOUD_SECRET_ID/KEY — that mismatch is incoherent and should be resolved.

Instruction Scope

SKILL.md instructions are focused on installing clscli, setting Tencent Cloud credentials, and running clscli commands to list topics, query logs, and get context. The instructions do not ask the agent to read unrelated files, search system state, or transmit data to unexpected external endpoints.

Install Mechanism

There is no packaged install spec in the registry; instead SKILL.md instructs users to 'brew tap dbwang0130/clscli' and install from that tap (a third‑party Homebrew tap). That introduces risk because binaries will come from a user tap (not clearly an official Tencent release). The homepage is a generic https://github.com/ link (not a specific repo), and source is 'unknown', which prevents verification of the installer.

Credentials

The only environment variables the skill needs (per SKILL.md) are TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY — appropriate for calling Tencent APIs. The inconsistency between the registry's declared 'none' and SKILL.md's env requirements is concerning because it hides the need for secrets in the registry metadata.

Persistence & Privilege

The skill is instruction-only with no code files and does not request always:true or other elevated persistent privileges. It does, however, instruct the user to install a binary which will persist on the system — that's normal for a CLI integration but increases local risk compared with a pure instruction skill.

What to consider before installing

Before installing or using this skill: 1) Verify the clscli binary source — find the official GitHub repo or release page and confirm the Homebrew tap (dbwang0130) is trustworthy. A generic homepage (https://github.com/) and 'source: unknown' are red flags. 2) Prefer installing from an official Tencent release or a well-reviewed package; avoid installing binaries from untrusted personal taps. 3) Only provide TENCENTCLOUD_SECRET_ID/KEY if you trust the clscli binary; consider using temporary, limited-scope credentials or a read-only account scoped to the CLS resources needed. 4) Inspect the clscli project's code/release artifacts (and its Homebrew formula) before running them. 5) If you must test quickly, run clscli in an isolated environment (container or VM) to limit potential impact. These steps will reduce risk and would increase confidence that the skill is safe to use.

CLS Skill

Query and analyze Tencent Cloud CLS logs.

Setup

1. Install clscli (Homebrew):

   brew tap dbwang0130/clscli
   brew install dbwang0130/clscli/clscli
   

2. Get credentials and region list: https://cloud.tencent.com/document/api/614/56474
3. Set environment variables (same as Tencent Cloud API common parameters):

   export TENCENTCLOUD_SECRET_ID="your-secret-id"
   export TENCENTCLOUD_SECRET_KEY="your-secret-key"
   

4. Specify region via --region (e.g. ap-guangzhou).

Usage

!IMPORTANT: If you do not know the log topic, list topics first.

List log topics

List topics in a region to determine which --region and topic ID to use for query/context.

clscli topics --region <region> [--topic-name name] [--logset-name name] [--logset-id id] [--limit 20] [--offset 0]

Examples: --output=json, --output=csv, -o topics.csv

Option	Required	Description
--region	yes	CLS region, e.g. ap-guangzhou
--topic-name	no	Filter by topic name (fuzzy match)
--logset-name	no	Filter by logset name (fuzzy match)
--logset-id	no	Filter by logset ID
--limit	no	Page size, default 20, max 100
--offset	no	Pagination offset, default 0
--output, -o	no	Output: json, csv, or file path

Output columns: Region, TopicId, TopicName, LogsetId, CreateTime, StorageType.

Get log by query

clscli query -q "[query condition] | [SQL statement]" --region <region> -t <TopicId> --last 1h

Examples:

• Time: --last 1h, --last 30m; or --from/--to (Unix ms)
• Multiple topics: --topics <id1>,<id2> or multiple -t <id>
• Auto pagination and cap: --max 5000 (paginate until 5000 logs or ListOver)
• Output: --output=json, --output=csv, -o result.json (write to file)

Option	Required	Description
--region	yes	CLS region, e.g. ap-guangzhou
-q, --query	yes	Query condition or SQL, e.g. level:ERROR or * | select count(*) as cnt
-t, --topic	one of -t/--topics	Single log topic ID
--topics	one of -t/--topics	Comma-separated topic IDs, max 50
--last	one of --last/--from/--to	Time range, e.g. 1h, 30m, 24h
--from, --to	one of --last/--from/--to	Start/end time (Unix ms)
--limit	no	Logs per request, default 100, max 1000
--max	no	Max total logs; when non-zero, auto-paginate until reached or ListOver
--output, -o	no	Output: json, csv, or file path
--sort	no	Sort: asc or desc, default desc

Query condition syntax

Two syntaxes are supported:

• CQL (CLS Query Language): CLS-specific query syntax for logs, easy to use, recommended.
• Lucene: Open-source Lucene syntax; not designed for log search, has more restrictions on special chars, case, wildcards; not recommended.

CQL syntax

Syntax	Description
key:value	Key-value search; logs where field (key) contains value, e.g. level:ERROR
value	Full-text search; logs containing value, e.g. ERROR
AND	Logical AND, case-insensitive, e.g. level:ERROR AND pid:1234
OR	Logical OR, case-insensitive, e.g. level:ERROR OR level:WARNING, level:(ERROR OR WARNING)
NOT	Logical NOT, case-insensitive, e.g. level:ERROR NOT pid:1234, level:ERROR AND NOT pid:1234
()	Grouping for precedence, e.g. level:(ERROR OR WARNING) AND pid:1234. Note: AND has higher precedence than OR when no parentheses.
" "	Phrase search; double-quoted string, words and order must match, e.g. name:"john Smith". No logical operators inside phrase.
' '	Phrase search; single quotes, same as ""; use when phrase contains double quotes, e.g. body:'user_name:"bob"'
*	Wildcard; zero or more chars, e.g. host:www.test*.com. No prefix wildcard.
>, >=, <, <=, =	Range operators for numeric values, e.g. status>400, status:>=400
\	Escape; escaped char is literal. Escape space, :, (), >, =, <, ", ', * in values.
key:*	text: field exists (any value). long/double: field exists and is numeric, e.g. response_time:*
key:""	text: field exists and is empty. long/double: value is not numeric or field missing, e.g. response_time:""

SQL statement syntax

Syntax	Description
SELECT	Select from table; data from current log topic matching query condition
AS	Alias for column (KEY)
GROUP BY	With aggregate functions, group by one or more columns (KEY)
ORDER BY	Sort result set by KEY
LIMIT	Limit rows, default 100, max 1M
WHERE	Filter raw data
HAVING	Filter after GROUP BY, before ORDER BY; WHERE filters raw data
Nested subquery	One SELECT inside another for multi-step analysis
SQL functions	Richer analysis: IP geo, time format, string split/join, JSON extract, math, distinct count, etc.

Describe log context

Retrieve log context around a given log.

clscli context <PkgId> <PkgLogId> --region <region> -t <TopicId>

Examples: --output=json, --output=csv, -o context.json (write to file)

Option	Required	Type	Description	Example
--region	yes	String	CLS region	ap-guangzhou
-t, --topic	yes	String	Log topic ID	-
PkgId	yes	String	Log package ID, i.e. SearchLog Results[].PkgId	528C1318606EFEB8-1A7
PkgLogId	yes	Integer	Index within package, i.e. SearchLog Results[].PkgLogId	65536
--output, -o	no	-	Output: json, csv, or file path	-