Byted Tos Image Process

This skill appears to implement exactly what it claims (TOS image processing), but the registry metadata omits the sensitive environment variables the scripts actually require. Before installing or running it: - Do not supply long-lived, high-privilege credentials. Prefer short-lived STS tokens limited to the specific buckets/keys needed. - Verify and reconcile metadata: the registry should declare required env vars (TOS_ACCESS_KEY, TOS_SECRET_KEY, TOS_ENDPOINT, TOS_REGION, optional TOS_SECURITY_TOKEN). Ask the publisher to correct the metadata if you rely on that for automation. - Inspect the bundled scripts yourself (they are included) and confirm they only call the official TOS SDK — no hidden endpoints were found in the provided files. - If you will run the scripts, run them in a sandbox or isolated environment and test with a dedicated test bucket that has minimal permissions (read/write only where needed). Revoke credentials after testing. - Review the Python dependency 'tos' from PyPI (or your package source) to ensure it is the legitimate SDK the scripts expect. - If you do not trust the publisher, do not enable autonomous invocation for this skill in agents that hold sensitive credentials. If the publisher updates the registry metadata to list the required environment variables and primary credential, and you follow the least-privilege guidance above, the incoherence will be resolved and the skill will be more straightforward to trust.