volcengine-tos-vectors-skills

Manage vector storage and similarity search using TOS Vectors service. Use when working with embeddings, semantic search, RAG systems, recommendation engines, or when the user mentions vector databases, similarity search, or TOS Vectors operations.

This skill appears to be a legitimate TOS Vectors helper, but the package metadata is incomplete: the scripts and SKILL.md require three environment variables (TOS_ACCESS_KEY, TOS_SECRET_KEY, TOS_ACCOUNT_ID) and the `tos` Python SDK, yet the registry lists none. Before installing or enabling this skill: - Verify the skill source and author (owner id present but homepage/source is unknown). Prefer skills with a known homepage or repo. - Don’t supply high-privilege TOS keys unless you trust the skill and its source. Use least-privilege keys and an account dedicated to testing if possible. - Confirm the endpoint domains (https://tosvectors-cn-beijing.volces.com and https://tosvectors-cn-beijing.ivolces.com) are legitimate for your provider; if unsure, contact the provider or use an official SDK/endpoint. - If you plan to use the CLI scripts, ensure the `tos` SDK version (README suggests a beta) is appropriate and audit that package separately before pip installing. - Ask the publisher/maintainer to update registry metadata to declare required env vars and any install steps so automated tooling and users are not misled. Given the clear metadata mismatch (credentials required but not declared) the skill is suspicious—not necessarily malicious—but you should validate the origin and limit credentials before use.

Type: OpenClaw Skill Name: volcengine-tos-vectors-skills Version: 1.0.2 The skill bundle is designed for managing vector storage and similarity search using the Volcengine TOS Vectors service. All Python scripts and markdown documentation consistently interact with the legitimate Volcengine endpoint `https://tosvectors-cn-beijing.volces.com`. Credentials (TOS_ACCESS_KEY, TOS_SECRET_KEY, TOS_ACCOUNT_ID) are read from environment variables, which is standard practice for cloud SDKs. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent. The content is clearly aligned with its stated purpose.