Tencent MPS

Key points before installing or using this skill: - This skill's scripts require your Tencent Cloud SecretId and SecretKey (and often COS bucket/region). The registry metadata currently does NOT declare these required env vars — treat that as a red flag and require the publisher to correct it. - Do NOT paste your SecretId/SecretKey into a chat/conversation. SKILL.md suggests the agent can help configure if you send values in the conversation — that would expose secrets to the agent and any logs. Use a secure secret injection mechanism instead (platform secret store, environment variables injected by an admin, or an IAM role with minimal privileges). - Inspect mps_load_env.py and any code that auto-loads environment files before running: the scripts reference loading env from /etc/environment, ~/.profile, etc. Verify what files are read and whether any code writes to or parses arbitrary system files. - Limit credentials: if you must provide keys, create least-privilege credentials scoped to MPS/COS actions only and avoid using owner/administrator keys. Prefer short-lived credentials or COS pre-signed URLs where possible. - Be aware of billing: many operations call Tencent MPS and will incur costs. The SKILL.md reminds about costs — confirm expected costs and test with dry-run (--dry-run) first. - Verify link and TaskId handling: SKILL.md requires Markdown links and explicit TaskId output. Make sure any automation that parses script stdout cannot be coerced to exfiltrate secrets via those outputs. - If you are not comfortable supplying cloud credentials or allowing the skill to read environment files, do not install or run it. Consider running the scripts locally in an isolated environment (container or VM) after manually reviewing the code. If you want, I can: (1) highlight the exact places in the code that read environment files or prompt for secrets, (2) summarize which scripts require which env vars, or (3) suggest minimal IAM policies to limit the provided credentials.