七牛云对象存储

上传本地文件到七牛对象存储，返回可交付的下载链接。当用户提到"上传""七牛""对象存储""OSS""交付链接""公网链接""签名链接"时引用；当已有本地文件需要上传并获得可访问的 URL 时引用；当工作流完成内容生成后进入交付阶段时引用。自动按扩展名判定文件类型，私有空间返回签名链接，公开空间返回公网链接。

This skill appears to do what it says: upload local files to Qiniu and return either a public URL or a signed private URL. Before installing or using it: - Ensure you only provide QINIU_ACCESS_KEY and QINIU_SECRET_KEY for an account/bucket you control; treat QINIU_SECRET_KEY as sensitive. - Confirm QINIU_PUBLIC_DOMAIN is the correct domain that will host objects. - Decide whether the bucket should be private (QINIU_IS_PRIVATE=true) — the skill will by default return signed URLs for private buckets. - Note the code writes logs to OUTPUT_ROOT (defaults to your home directory) — check and manage those logs if they contain filenames you consider sensitive. - The scripts declare Python >=3.14; if your environment has an older Python, the scripts may fail. - Be aware of minor documentation inconsistencies: references/usage.md mentions api_key/qiniu.json but the code only reads env vars; examples show differing default expiry values (600 vs 1800 seconds). Consider testing the skill in a safe environment with a non-production bucket and verifying behavior before using it in production.

Type: OpenClaw Skill Name: qiniu-object-storage Version: 1.0.0 The skill bundle provides a legitimate implementation for uploading local files to Qiniu Object Storage and generating signed or public download URLs. The code in `scripts/common.py`, `scripts/upload_file.py`, and `scripts/generate_private_download_url.py` correctly implements Qiniu's authentication and upload protocols using standard libraries. It communicates only with official Qiniu endpoints (e.g., `upload-z2.qiniup.com`) and handles sensitive credentials (Access/Secret Keys) appropriately via environment variables for its stated purpose. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.