← 返回 Skills 市场

Volcengine TOS Smoke Test

Name: Volcengine TOS Smoke Test
Author: day253

作者 day253 · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

328

总下载

当前安装

版本数

在 OpenClaw 中安装

/install day253-volcengine-storage-tos-test

功能描述

Minimal TOS smoke tests. Validate AK/SK config, list buckets, and upload/download with Volcengine TOS. Supports both tosutil CLI and tos_manage.py script.

使用说明 (SKILL.md)

Category: test

TOS 对象存储最小可行性测试

Goals

验证 AK/SK/Region/Endpoint 配置正确。
验证 TOS 访问（列桶、上传、下载）。

Prerequisites

已配置 AK/SK（环境变量或 .env）。
已准备一个可读写的 TOS Bucket。

方式一：使用 tos_manage.py 脚本（推荐）

依赖：pip install tos

1) 列出 Bucket

python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py list-buckets --print-json

2) 列出对象

python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py list-objects \
  --bucket \x3Cbucket> --prefix "" --max-keys 20 --print-json

3) 上传小文件

echo "tos-manage-test-$(date +%s)" > /tmp/tos-test.txt
python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py upload \
  --bucket \x3Cbucket> --key tests/tos-test.txt --file /tmp/tos-test.txt --print-json

4) 获取元数据

python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py head \
  --bucket \x3Cbucket> --key tests/tos-test.txt --print-json

5) 下载并校验

python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py download \
  --bucket \x3Cbucket> --key tests/tos-test.txt --file /tmp/tos-test-down.txt
diff /tmp/tos-test.txt /tmp/tos-test-down.txt && echo "PASS: content matches" || echo "FAIL: content mismatch"

6) 生成预签名 URL

python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py presign \
  --bucket \x3Cbucket> --key tests/tos-test.txt --expires 300 --print-json

7) 清理测试文件

python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py delete \
  --bucket \x3Cbucket> --key tests/tos-test.txt --confirm

方式二：使用 tosutil CLI

tosutil 是火山引擎官方 TOS 命令行工具，需单独下载安装。参考：https://www.volcengine.com/docs/6349/148772

1) 查看配置

tosutil config

2) 列出 Bucket

tosutil ls

3) 列出对象（指定 bucket）

tosutil ls tos://\x3Cbucket> -s --limited-num 20

4) 上传小文件

echo "tosutil-test-$(date +%s)" > /tmp/tosutil-test.txt
tosutil cp /tmp/tosutil-test.txt tos://\x3Cbucket>/tests/tosutil-test.txt

5) 下载并校验

tosutil cp tos://\x3Cbucket>/tests/tosutil-test.txt /tmp/tosutil-test-down.txt
diff /tmp/tosutil-test.txt /tmp/tosutil-test-down.txt && echo "PASS" || echo "FAIL"

6) 清理

tosutil rm tos://\x3Cbucket>/tests/tosutil-test.txt

Expected Results

list-buckets / tosutil ls 能返回至少一个 bucket。
上传成功返回 ETag / status 200。
下载文件内容与上传一致（diff 无输出）。
head 返回正确的 content_length 和 content_type。
预签名 URL 可访问。

常见失败

现象	原因	解决
403 AccessDenied	AK/SK 错误或无权限	检查 IAM 策略，确认允许 `tos:*` 或最小读写权限
Endpoint 不可达	Region 与 Endpoint 不匹配	端点格式为 `tos-{region}.volces.com`
NoSuchBucket	Bucket 名拼写或 Region 错误	先 `list-buckets` 确认桶存在
上传成功但下载内容不一致	网络中断或部分写入	检查 ETag 或重新上传

安全使用建议

This skill's instructions are plausible for testing Volcengine TOS, but the package is incomplete and metadata is inconsistent. Before installing or running: 1) Ask the publisher for the missing script(s) (tos_manage.py and any bundled helpers) or confirm the intended install location — the SKILL.md references files that are not included. 2) Confirm which environment variables are required (AK/SK, REGION, ENDPOINT) and how they should be provided; the skill should declare these in its metadata. 3) Only provide AK/SK to trusted code; if you must run these tests, prefer using an IAM key with minimal read/write scope and a throwaway test bucket. 4) If you cannot obtain the missing scripts from a trusted source, treat this as incomplete/untrusted and do not run arbitrary downloaded scripts. Additional information that would change this assessment to benign: the skill bundle includes the referenced scripts, or the metadata explicitly declares the required env vars and a trustworthy install path for the test tooling.

功能分析

Type: OpenClaw Skill Name: day253-volcengine-storage-tos-test Version: 1.0.0 The skill bundle provides documentation and instructions for testing Volcengine TOS (Object Storage) using a Python script (tos_manage.py) and the official tosutil CLI. The described operations—listing buckets, uploading/downloading files, and generating presigned URLs—are standard administrative tasks for cloud storage. No evidence of data exfiltration, malicious execution, or prompt injection was found in the provided files (SKILL.md and _meta.json).

能力评估

⚠ Purpose & Capability

The name/description match the instructions (TOS smoke tests). However the SKILL.md calls out a local script path (python skills/storage/tos/volcengine-storage-tos/scripts/tos_manage.py) that is not included in the package. The skill also fails to declare the obvious required credentials (AK/SK/Region/Endpoint) in its metadata. That mismatch (expects packaged test script + credentials, provides neither) is disproportionate.

⚠ Instruction Scope

Instructions are explicit about running commands that list buckets, upload/download files, create temp files under /tmp, and using either tos_manage.py or the tosutil CLI. Those actions are consistent with a storage smoke test, but the instructions assume a local script path and environment variables or a .env file. They do not instruct any broad data collection or exfiltration, but they do assume secrets (AK/SK) are present without declaring them. The missing script files means the agent would be told to execute commands that will fail or that rely on externally supplied code.

ℹ Install Mechanism

This is instruction-only (no install spec), which is low-risk. The README instructs installing a Python package 'tos' (pip install tos) and separately installing tosutil manually; those are reasonable but are not enforced by the skill metadata. Because the skill references a local script that isn't bundled, a user would need to obtain or install that script from elsewhere — this is a packaging/availability problem, not necessarily malicious, but it raises operational risk.

⚠ Credentials

The skill metadata lists no required env vars or primary credential, yet the SKILL.md explicitly requires AK/SK (via environment variables or a .env file), plus Region/Endpoint and an existing bucket. Requesting cloud credentials would be proportional to the stated purpose, but they should be declared in requires.env and primaryEnv. The omission is an incoherence that could lead to unexpected behavior.

✓ Persistence & Privilege

The skill does not request persistent/always-on presence and uses the default model-invocation behavior. It does not ask to modify other skills or system-wide settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install day253-volcengine-storage-tos-test
安装完成后，直接呼叫该 Skill 的名称或使用 /day253-volcengine-storage-tos-test 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: TOS connectivity and upload/download smoke test

元数据

Slug day253-volcengine-storage-tos-test

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题