qiniu-kodo

七牛云 KODO 对象存储技能。支持文件上传、下载、列出、删除、获取 URL 等操作。 三层架构：MCP 工具（优先）→ Node.js SDK → qshell CLI。

This skill appears to be a normal Qiniu KODO client, but there are a few red flags to review before installing: - The package declares Python/binaries (python3, pip3) and a python MCP package in metadata, but the distributed code is Node.js only and a referenced scripts/qiniu_python file is missing — ask the author or check for a missing Python implementation. - The installer (scripts/setup.sh) will create config/qiniu-config.json containing your AccessKey/SecretKey, append exports to your shell rc (~/.bashrc or ~/.zshrc), configure ~/.mcporter, and may perform global npm installs and move qshell into /usr/local/bin (uses sudo). Inspect the script fully and do not run it as root without review. - Because credentials are persisted on disk and in shell profile, prefer using least-privileged or ephemeral keys, or manually create the config file instead of running the automated installer. - If you want to proceed: run the setup script in a controlled environment (container or VM), avoid global installs by editing the script or running with --check-only first, and verify network downloads (qshell) point to official domains. Ask the maintainer to fix metadata (declare required env vars and either include or remove Python references) before trusting this skill in production.

Type: OpenClaw Skill Name: qiniu-kodo Version: 1.0.3 The skill bundle provides a legitimate integration for Qiniu Cloud KODO storage, implementing standard operations like file upload, download, and management. The `setup.sh` script handles environment configuration and credential storage locally (including shell profile exports), and the `qiniu_node.mjs` script utilizes the official Qiniu Node.js SDK. All external resources, such as the `qshell` binary downloaded from devtools.qiniu.com, are from official sources, and no evidence of malicious intent or data exfiltration was found.