Tencent Cloud COS

This package mostly does what it claims (Tencent COS + CI operations) but there are a few actionable things to verify before installing or giving credentials: - Metadata mismatch: the registry summary says 'no required env vars' but the skill and scripts require TENCENT_COS_SECRET_ID and TENCENT_COS_SECRET_KEY (and optionally TENCENT_COS_TOKEN). Ask the publisher to correct the metadata if you care about declared permissions. - Prefer ephemeral STS tokens: use temporary STS credentials (Token) rather than permanent root/owner keys. The SKILL.md itself recommends sub-account least-privilege keys and STS — follow that. - Avoid persisting secrets: run setup with --from-env (no --persist) so credentials remain in your shell session only. If you must persist, inspect .env and .env.enc afterwards and store them securely. - Inspect files locally: the repository includes scripts/setup.sh and scripts/cos_node.mjs; review these files (you already have them) and confirm the endpoints called are Tencent COS/CI domains. The code provided does not call unknown third-party endpoints. - Confirm npm package provenance: cos-nodejs-sdk-v5 is the expected SDK; if you rely on supply-chain security, validate the package checksum or install in an isolated environment. - Be aware of .env.enc fallback: cos_node.mjs will attempt to decrypt .env.enc and fall back to .env if decryption fails; if you share both files in a repo, the fallback behavior could expose creds. Keep .env/.env.enc out of shared repos. If you want extra assurance, run the skill in an isolated container or VM, use a least-privilege COS sub-account, and test with short-lived STS credentials first.