Aliyun Vod Manage

Use when managing Alibaba Cloud ApsaraVideo VOD resources and media workflows via OpenAPI/SDK, including upload and media asset operations, transcoding templ...

Security Scan

The skill's files and runtime instructions are coherent with a VOD management helper for Alibaba Cloud; it fetches public API metadata and documents how to call VOD OpenAPI, though the SKILL.md mentions credential sources that are not declared in metadata.

Purpose & Capability

The name/description (manage Alibaba ApsaraVideo VOD) matches the included instructions, templates, and a helper script that discovers API metadata. Minor inconsistency: SKILL.md documents use of ALICLOUD_ACCESS_KEY_ID/ALICLOUD_ACCESS_KEY_SECRET/ALICLOUD_REGION_ID and ~/.alibabacloud/credentials as credential priorities, but the skill's registry metadata lists no required env vars or primary credential. This appears to be a documentation/manifest omission rather than malicious mismatch.

Instruction Scope

Runtime instructions are focused on VOD API discovery, read-only validation, and then explicit mutate operations when requested. They instruct saving API inventory, request parameters and IDs under output/aliyun-vod-manage/. The SKILL.md asks agents to prefer read-only APIs first and to confirm region/scope before writes. There are no instructions to transmit data to unexpected external endpoints beyond the documented api.aliyun.com metadata endpoint.

Install Mechanism

Instruction-only skill with no install spec. The only included script uses the Python standard library to fetch public metadata; nothing is downloaded or installed.

Credentials

The skill reasonably requires Alibaba Cloud credentials in order to perform mutations, and SKILL.md documents expected env vars and shared credential file locations. However, these credentials are not declared in the registry 'requires.env' or as a primary credential, which is an omission. The instructions also direct saving request parameters and responses to disk — users should ensure secrets (AccessKeySecret, temporary tokens) are not inadvertently persisted in evidence files.

Persistence & Privilege

always: false and disable-model-invocation: false (normal). The skill does not request persistent system-wide privileges or modify other skills; it only writes outputs under its own output directory.

Assessment

This skill is coherent for managing Alibaba Cloud VOD: it includes API discovery templates and a small script that fetches public metadata from api.aliyun.com. Before installing or invoking it, confirm: (1) you will need Alibaba Cloud credentials for any write operations — SKILL.md documents env vars (~/.alibabacloud/credentials) but the registry metadata does not declare them, so expect to provide them at runtime; (2) the skill writes request payloads/responses to output/aliyun-vod-manage/ — do not allow it to persist secret values (AccessKeySecret, STS tokens) in evidence files; (3) network access is only to api.aliyun.com as shown in code, but if you plan to run mutation operations, use least-privilege RAM or STS credentials and confirm the agent's prompts before any write. If you are uncomfortable with the agent having autonomous access to credentials or writing evidence to disk, disable autonomous invocation or run the skill in an isolated environment.

Category: service

ApsaraVideo VOD

Validation

mkdir -p output/aliyun-vod-manage
python -m py_compile skills/media/vod/aliyun-vod-manage/scripts/list_openapi_meta_apis.py
echo "py_compile_ok" > output/aliyun-vod-manage/validate.txt

Pass criteria: command exits 0 and output/aliyun-vod-manage/validate.txt is generated.

Output And Evidence

• Save API inventory and operation evidence under output/aliyun-vod-manage/.
• Keep region, media IDs, template IDs, and request parameters in evidence files.

Use Alibaba Cloud OpenAPI (RPC) with official SDKs or OpenAPI Explorer to manage VOD resources. Prefer metadata-first API discovery before mutate operations.

Prerequisites

• Prepare least-privilege RAM AccessKey/STS credentials.
• Confirm target region and media scope before changes.
• Use read-only Describe* / List* APIs first.

Workflow

1. Confirm target media IDs, storage scope, and desired operation.
2. Discover API names and required parameters via metadata and API Explorer.
3. Execute read-only validation calls.
4. Execute upload/process/playback/configuration operations.
5. Save outputs and evidence under output/aliyun-vod-manage/.

AccessKey Priority

1. Environment variables: ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET / ALICLOUD_REGION_ID.
2. Shared config file: ~/.alibabacloud/credentials.

If region is ambiguous, ask before write operations.

API Discovery

• Product code: vod
• Default API version: 2017-03-21
• Metadata source: https://api.aliyun.com/meta/v1/products/vod/versions/2017-03-21/api-docs.json

Minimal Executable Quickstart

python skills/media/vod/aliyun-vod-manage/scripts/list_openapi_meta_apis.py

Optional overrides:

python skills/media/vod/aliyun-vod-manage/scripts/list_openapi_meta_apis.py \
  --product-code vod \
  --version 2017-03-21 \
  --output-dir output/aliyun-vod-manage

Common Operation Mapping

• Upload and assets: CreateUploadVideo, CreateUploadImage, GetPlayInfo, SearchMedia
• Media management: GetVideoInfo, UpdateVideoInfo, DeleteVideo
• Transcode/templates: AddTranscodeTemplateGroup, UpdateTranscodeTemplateGroup, SubmitTranscodeJobs
• Snapshot/AI jobs: SubmitSnapshotJob, SubmitAIJob, GetJobDetail
• Security/play auth: GetVideoPlayAuth, SetMessageCallback, SetDefaultWatermark

Output Policy

Write all generated files and execution evidence under: output/aliyun-vod-manage/

References

• Source list: references/sources.md
• Task templates: references/templates.md