Byted Tos Doc Process

What to consider before installing: - The scripts require TOS credentials and configuration (TOS_ACCESS_KEY, TOS_SECRET_KEY, TOS_ENDPOINT, TOS_REGION, and typically TOS_BUCKET and TOS_OBJECT_KEY). The registry metadata incorrectly omitted these requirements — assume you must supply them. - These are sensitive credentials. Prefer using short-lived STS credentials (TOS_SECURITY_TOKEN) and least-privilege keys (read-only for preview, or a narrowly-scoped write permission if using save-to-bucket). Do not provide full account keys unless necessary. - Review the included scripts yourself (they are shipped with the skill). They generate pre-signed URLs and make HTTP requests to TOS, save files locally, and optionally request TOS to write converted outputs back to a bucket. Ensure output paths and save buckets are what you expect. - The README/SKILL.md include large base64 tokens as examples for HTML-preview decoding; these are sample data used by the parsing logic and not necessarily malicious, but confirm any real tokens/URLs you use are legitimate. - Verify the 'tos' Python package is the official SDK from a trusted source (PyPI) before pip-installing it in your environment. - Run the skill in a controlled environment the first time (isolated VM/container), and avoid exposing high-privilege keys. If you test with production credentials, consider rotating them afterwards. If you want to proceed: provide minimally-privileged credentials, or use an STS token, and double-check TOS_BUCKET/TOS_OBJECT_KEY values. If you do not control the skill's origin/trust, treat it as untrusted code and review thoroughly before supplying secrets.