Alibabacloud Oss Manage Cron Upload
v0.0.1Alibaba Cloud OSS scheduled local-folder sync skill using aliyun CLI, including integrated ossutil commands for incremental upload. Use when the user wants t...
⭐ 0· 41·0 current·0 all-time
byalibabacloud-skills-team@sdk-team
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description promise (local-folder scheduled sync to Alibaba Cloud OSS) lines up with the instructions: everything is executed via the aliyun CLI (integrated ossutil), scheduler configuration is OS-local, and RAM policy guidance maps directly to the required OSS actions. No unrelated environment variables, binaries, or install steps are requested.
Instruction Scope
The SKILL.md is prescriptive and narrowly scoped to aliyun CLI checks, ossutil cp usage, bucket verification/creation (with explicit user confirmation), and local scheduler setup. It also instructs the agent to run configuration commands such as `aliyun configure ai-mode enable` and `aliyun configure set --auto-plugin-install true`, which modify local CLI config—this is consistent with the skill's purpose but is an important host-side action the user should expect. The docs explicitly forbid the agent from inlining or printing credentials and require strict parameter validation and rejection of shell metacharacters, which reduces risk.
Install Mechanism
Instruction-only skill with no install spec and no archives to download. The repository only documents how to install aliyun CLI (for human operators) but does not include an automated installer. This is low-risk and appropriate for the described use case.
Credentials
The skill requests no new environment variables or credentials; it relies on an existing, preconfigured aliyun CLI profile. Documentation includes examples of how humans would provide Access Key / STS credentials outside an agent session, and the SKILL.md explicitly forbids agent-driven credential setting. The RAM policy guidance matches the minimum privileges required for listing/creating a bucket and uploading objects.
Persistence & Privilege
always is false and the skill does not request permanent system-wide privileges or modifications to other skills. Autonomous invocation is allowed (platform default) but the skill's runtime actions are limited to local CLI calls and scheduler registration—appropriate for its purpose.
Assessment
This skill appears coherent and implements a CLI-first local-to-OSS sync flow. Before installing or running it: (1) verify you trust the host/machine the agent will run on because the skill runs aliyun CLI commands that use your existing profile and will modify local CLI config (ai-mode and auto-plugin settings) and create OS-level scheduler entries; (2) do not provide credentials to the agent—configure aliyun credentials yourself outside the agent session as the docs instruct; (3) review and apply least-privilege RAM policies described in references/ram-policies.md so uploads only get the permissions they need; (4) confirm the skill's strict parameter validation meets your needs (it forbids shell metacharacters) and double-check any cron/Task Scheduler commands before enabling them; (5) if you need higher assurance, inspect SKILL.md and the reference files yourself (they are the only code in this package) and test on a non-production machine first.Like a lobster shell, security has layers — review code before you run it.
latestvk970pspyb18rn40n4mb1ezapa583y526
License
MIT-0
Free to use, modify, and redistribute. No attribution required.