腾讯云COS存储

This skill appears to be what it claims: a Tencent COS + CI integration implemented with the official Node SDK. Before installing, check these points: 1) Metadata mismatch — the registry summary shows no required env vars but the SKILL.md requires SecretId/SecretKey (and optional Token), Region and Bucket. Treat SKILL.md as authoritative but confirm with the publisher. 2) Use least-privilege credentials: create a sub-account with COS-only permissions and prefer STS temporary credentials (recommended by the skill). 3) Avoid using --persist unless you understand the tradeoffs; if you persist, the script writes a local .env (permissions 600) and can create a machine-bound .env.enc — make backups if you need portability. 4) Verify npm package provenance (cos-nodejs-sdk-v5) and run npm install in an isolated/project-local environment (not system-wide). 5) Because source/homepage are unknown, prefer running this in a controlled environment (container or dedicated user) the first time and review network traffic if you need to be extra cautious. If you want, provide the registry owner/homepage or a checksum of cos_node.mjs for further verification.