Alicloud Storage Oss Ossutil

Alibaba Cloud OSS CLI (ossutil 2.0) skill. Install, configure, and operate OSS from the command line based on the official ossutil overview.

Security Scan

The skill is internally consistent with its stated purpose (guidance for installing and using Alibaba Cloud's ossutil CLI); it contains no unexpected credential requests or hidden network endpoints and the small included script only checks for the binary and writes local evidence.

Purpose & Capability

Name/description map directly to the provided documentation and examples for ossutil 2.0. The files (SKILL.md, install references, sources) and the validation script relate to installing, configuring, and using Alibaba Cloud OSS via ossutil; no unrelated services or credentials are requested.

Instruction Scope

SKILL.md stays on-topic: it instructs how to install, configure, and run ossutil, how to set AK/SK via env or config file, how to run list/upload/download/sync, and to save outputs under output/alicloud-storage-oss-ossutil/. The included check_ossutil.py only verifies the presence/version of ossutil and writes a local validate.txt; it does not transmit data externally.

Install Mechanism

There is no automated install spec in the registry, but references/install.md shows curl downloads from gosspublic.alicdn.com (Alibaba's public CDN) and unzip/move into /usr/local/bin. This is proportional for installing a CLI but involves executing network-downloaded binaries — verify official URLs and checksums before running.

Credentials

The skill does not declare required environment variables in the registry metadata, but the docs recommend using ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, and optional ALICLOUD_REGION_ID or a credentials file. Asking the user to provide OSS credentials is expected for this CLI; the guidance to prefer RAM and avoid passing secrets on the command line is appropriate.

Persistence & Privilege

always is false and the skill does not request persistent system privileges or modify other skills. The agent-invocation defaults are standard and appropriate for a tool-integration skill.

Assessment

This skill appears to be a straightforward OSS/ossutil helper. Before installing or running commands: (1) verify the referenced download URLs (gosspublic.alicdn.com) and, if possible, check an official checksum or signature; (2) prefer using Alibaba Cloud RAM users with least privilege and store credentials in a config file or environment variables rather than passing them on the command line; (3) review and run the included check_ossutil.py locally to confirm ossutil availability (it only checks version and writes a local file); (4) run installation steps in a controlled environment (or sandbox) if you do not fully trust the system where you intend to install the CLI.

Category: tool

OSS (ossutil 2.0) CLI Skill

Validation

python skills/storage/oss/alicloud-storage-oss-ossutil/scripts/check_ossutil.py --output output/alicloud-storage-oss-ossutil/validate.txt

Pass criteria: command exits 0 and output/alicloud-storage-oss-ossutil/validate.txt is generated.

Output And Evidence

• Save command outputs, object listings, and sync logs under output/alicloud-storage-oss-ossutil/.
• Keep at least one upload or listing result as evidence.

Goals

• Use ossutil 2.0 to manage OSS: upload, download, sync, and resource management.
• Provide a unified CLI flow for install, config, credentials, and region/endpoint handling.

Quick Start Flow

1. Install ossutil 2.0.
2. Configure AK/SK and default region (ossutil config or config file).
3. Run ossutil ls to list buckets, then list objects using the bucket region.
4. Execute upload/download/sync or API-level commands.

Install ossutil 2.0

• See references/install.md for platform-specific install steps.

Configure ossutil

• Interactive configuration:

ossutil config

• Default config file paths:
  • Linux/macOS：~/.ossutilconfig
  • Windows：C:\Users\issuser\.ossutilconfig

Main configuration fields include:

• AccessKey ID
• AccessKey Secret
• Region（example default cn-hangzhou; ask the user if the best region is unclear）
• Endpoint（optional; auto-derived from region if omitted）

AccessKey configuration notes

Use RAM users/roles with least privilege and avoid passing AK in plain text on command line.

Recommended method (environment variables):

export ALICLOUD_ACCESS_KEY_ID="<your-ak>"
export ALICLOUD_ACCESS_KEY_SECRET="<your-sk>"
export ALICLOUD_REGION_ID="cn-beijing"

ALICLOUD_REGION_ID can be used as default region; if unset choose the most reasonable region, ask user if unclear.

Or use the standard shared credentials file:

~/.alibabacloud/credentials

[default]
type = access_key
access_key_id = <your-ak>
access_key_secret = <your-sk>

Command structure (2.0)

• High-level command example:ossutil config
• API-level command example:ossutil api put-bucket-acl

Common command examples

ossutil ls
ossutil ls oss://your-bucket -r --short-format --region cn-shanghai -e https://oss-cn-shanghai.aliyuncs.com
ossutil cp ./local.txt oss://your-bucket/path/local.txt
ossutil cp oss://your-bucket/path/remote.txt ./remote.txt
ossutil sync ./local-dir oss://your-bucket/path/ --delete

Recommended execution flow (list buckets first, then objects)

1. List all buckets

ossutil ls

2. Get target bucket region from output (e.g. oss-cn-shanghai) and convert it to --region format (cn-shanghai).

3. When listing objects, explicitly set --region and -e to avoid cross-region signature/endpoint errors.

ossutil ls oss://your-bucket \
  -r --short-format \
  --region cn-shanghai \
  -e https://oss-cn-shanghai.aliyuncs.com

4. For very large buckets, limit output size first.

ossutil ls oss://your-bucket --limited-num 100
ossutil ls oss://your-bucket/some-prefix/ -r --short-format --region cn-shanghai -e https://oss-cn-shanghai.aliyuncs.com

Common errors and handling

• Error: region must be set in sign version 4.

  • Cause: missing region configuration.
  • Fix: add region in config file, or pass --region cn-xxx.

• The bucket you are attempting to access must be addressed using the specified endpoint

  • Cause: request endpoint does not match bucket region.
  • Fix: use endpoint of the bucket region, e.g. -e https://oss-cn-hongkong.aliyuncs.com.

• Invalid signing region in Authorization header

  • Cause: signature region does not match bucket region.
  • Fix: correct both --region and -e; both must match bucket region.

Credential and security guidance

• Prefer RAM user AK for access control.
• CLI options can override config file, but passing secrets on command line has leakage risk.
• In production, manage secrets via config files or environment variables.

Clarifying questions (ask when uncertain)

1. Is your target a Bucket or an Object?
2. Do you need upload/download/sync, or management actions like ACL/lifecycle/CORS?
3. What are the target region and endpoint?
4. Are you accessing OSS from ECS in the same region (intranet endpoint may be preferred)?

References

• OSSUTIL 2.0 overview and install/config:

  • https://help.aliyun.com/zh/oss/developer-reference/ossutil-overview

• Official source list:references/sources.md

Prerequisites

• Configure least-privilege Alibaba Cloud credentials before execution.
• Prefer environment variables: ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, optional ALICLOUD_REGION_ID.
• If region is unclear, ask the user before running mutating operations.

Workflow

1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
2. Run one minimal read-only query first to verify connectivity and permissions.
3. Execute the target operation with explicit parameters and bounded scope.
4. Verify results and save output/evidence files.