Tencent Cloud COS

Tencent Cloud Object Storage (COS) and Data万象 (CI) integration skill. Use this when you need to upload, download, and manage cloud storage files, or perform...

This skill appears to be a legitimate COS integration, but exercise caution before running its setup script. The setup script will persist your Tencent SecretId/SecretKey and other settings into shell startup files (~/.bashrc or ~/.zshrc), into ~/.mcporter/mcporter.json (it may embed secrets into command args), and may configure ~/.cos.conf via coscmd — all in clear text. Recommendations before installing: - Only provide a dedicated, least-privileged API key (SecretId/SecretKey) scoped to the specific bucket and actions required; avoid using your primary account keys. - Inspect scripts/setup.sh and references/config_template.json yourself; consider running setup steps manually rather than the script so you control what is written and where. - Prefer exporting credentials to a session or a dedicated credential file with restricted permissions (chmod 600) rather than adding them to shell rc. - Be cautious about global npm installs (mcporter) and npx: they run third-party code. Consider installing packages locally in an isolated environment or container. - After setup, verify ~/.mcporter/mcporter.json and ~/.cos.conf to confirm exactly what was written; remove secrets when no longer needed. - If unsure about the package author (source is unknown), avoid running automated install and instead use official Tencent tools or create your own minimal scripts that use the official SDK. What would change this assessment: if the skill metadata declared required env vars and primary credential up front, and if the setup script provided a non-persistent option (e.g., use environment-only or local config with restricted permissions rather than writing to shell rc), the concerns about transparency and persistence would be reduced.