七牛云对象存储

• Risk level: Low
• Analyzed: Apr 4, 2026, 2:08 PM
• Findings: 0
• Version: 1.0.0

Overview

This skill's code, required environment variables, and runtime instructions are consistent with its stated purpose of uploading local files to Qiniu and returning public or signed URLs.

This skill appears to do what it says: upload local files to Qiniu and return either a public URL or a signed private URL. Before installing or using it: - Ensure you only provide QINIU_ACCESS_KEY and QINIU_SECRET_KEY for an account/bucket you control; treat QINIU_SECRET_KEY as sensitive. - Confirm QINIU_PUBLIC_DOMAIN is the correct domain that will host objects. - Decide whether the bucket should be private (QINIU_IS_PRIVATE=true) — the skill will by default return signed URLs for private buckets. - Note the code writes logs to OUTPUT_ROOT (defaults to your home directory) — check and manage those logs if they contain filenames you consider sensitive. - The scripts declare Python >=3.14; if your environment has an older Python, the scripts may fail. - Be aware of minor documentation inconsistencies: references/usage.md mentions api_key/qiniu.json but the code only reads env vars; examples show differing default expiry values (600 vs 1800 seconds). Consider testing the skill in a safe environment with a non-production bucket and verifying behavior before using it in production.