# Alicloud Oss Ops

> A Claude skill from buhaiqing/aliyun-skills.

- **Type:** Skill
- **Install:** `agentstack add skill-buhaiqing-aliyun-skills-alicloud-oss-ops`
- **Verified:** Pending review
- **Seller:** [buhaiqing](https://agentstack.voostack.com/s/buhaiqing)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [buhaiqing](https://github.com/buhaiqing)
- **Source:** https://github.com/buhaiqing/aliyun-skills/tree/main/alicloud-oss-ops

## Install

```sh
agentstack add skill-buhaiqing-aliyun-skills-alicloud-oss-ops
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

---
name: alicloud-oss-ops
description: >-
  Use when the user needs to manage Alibaba Cloud Object Storage Service (OSS)
  — create, configure, list, and delete buckets; manage bucket ACL, lifecycle
  rules, CORS, logging, static website hosting, referer anti-leeching, cross-region
  replication, and access policies; upload, download, copy, delete, list, and
  restore objects; handle multipart uploads, presigned URLs, image processing,
  and Archive/ColdArchive data restore. User mentions OSS, Object Storage, 对象存储,
  OSS bucket, 存储空间, object, 对象, OSS文件, Bucket ACL, Bucket Policy, lifecycle,
  生命周期, CORS, 跨域, 静态网站, 防盗链, Referer白名单, 跨区域复制, 归档存储,
  分片上传, 断点续传, image processing, 图片处理, 签名URL, presign, S3-compatible
  — even without naming the product directly. Not for NAS file systems, HDFS,
  EBS disks, or CDN-only delivery (without OSS origin).
license: MIT
compatibility: >-
  Official Alibaba Cloud CLI (`aliyun`, Go binary, no runtime), Go 1.21+ runtime
  (for JIT SDK fallback), `ossutil` (recommended for data plane), valid API
  credentials, network access to Alibaba Cloud endpoints.
metadata:
  author: alicloud
  version: "1.1.0"
  last_updated: "2026-06-21"
  runtime: Harness AI Agent, Claude Code, Cursor, or compatible Agent runtimes
  go_version_minimum: "1.21"
  go_version_jit: "1.24+"
  api_profile: >-
    OSS 2019-05-17 (control plane) / https://help.aliyun.com/zh/oss/developer-reference/api-oss-2019-05-17-overview.
    Data plane uses S3-compatible REST API at ..
  cli_applicability: sdk-only
  cli_support_evidence: >-
    `aliyun oss ` is DEPRECATED — `aliyun --help` itself notes
    "阿里云OSS对象存储（废弃，请使用aliyun ossutil）". It only accepts ossutil
    shorthand verbs (ls, mb, cp, rm, stat, set-acl, set-meta, restore, sign,
    create-symlink, read-symlink, hash, help, config), NOT the OpenAPI operation
    names (ListBuckets / PutBucket / GetBucketInfo / ...) shown in the Operation
    tables below. Those tables document the OpenAPI surface; for actual
    execution, use one of:
      1. `./scripts/oss-skillopt-wrapper.sh  [args]` (primary,
         enables self-repair + Langfuse tracing), or
      2. `ossutil  [args]` (direct, no SkillOpt), or
      3. OSS Go SDK V2 (`github.com/aliyun/aliyun-oss-go-sdk/oss`) for the
         full API surface including those not in ossutil (lifecycle, CORS,
         replication, policy, encryption, versioning).
  environment:
    - ALIBABA_CLOUD_ACCESS_KEY_ID
    - ALIBABA_CLOUD_ACCESS_KEY_SECRET
    - ALIBABA_CLOUD_REGION_ID
---

> This skill follows the [Agent Skill OpenSpec](https://agentskills.io/specification).

# Alibaba Cloud Object Storage Service (OSS) Operations Skill

## Overview

Operational runbook for Alibaba Cloud OSS (12-nines durability). Execution paths:

| Path | When | Examples |
|------|------|----------|
| **Wrapper** → `ossutil` | ossutil-coverable operations | `ls`, `mb`, `cp`, `rm`, `stat`, `set-acl`, `restore`, `sign` |
| **OSS Go SDK V2** | Operations ossutil cannot cover | lifecycle, CORS, logging, referer, replication, policy, versioning, encryption, multipart |

> **Do not use the web console as the primary agent execution path.**

## Runtime Rules

| Area | Rule | Reference |
| --- | --- | --- |
| CLI path (control plane) | **MANDATORY**: Always prefer `./scripts/oss-skillopt-wrapper.sh` for ossutil-coverable operations; fallback to `ossutil` only when wrapper is unavailable. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md) |
| CLI path (data plane) | For upload/download/list, use `ossutil` directly (native data-plane tool). | [CLI](references/cli-usage.md) |
| Non-ossutil ops | Use OSS Go SDK V2 (`github.com/aliyun/aliyun-oss-go-sdk/oss`). | [API & SDK](references/api-sdk-usage.md) |
| Credentials | Read `{{env.*}}` from environment; wrapper auto-loads `.env` — never ask user to paste secrets. | [Integration](references/integration.md), [SkillOpt](references/skillopt-integration.md) |
| GCL | All write operations MUST pass GCL adversarial review before execution. | [GCL Rubric](references/rubric.md) |

> **`aliyun oss ` is DEPRECATED.** The operation tables below document the **OpenAPI surface** (PascalCase names: `ListBuckets`, `PutBucket`, ...). The `aliyun oss` CLI subcommand accepts **only ossutil-shorthand verbs** (`ls`, `mb`, `cp`, `rm`, `stat`, `set-acl`, ...). Use the Wrapper or `ossutil` at runtime. See [CLI Usage](references/cli-usage.md) for the full command map.

## Trigger & Scope (Agent-Readable)

### SHOULD Use This Skill When

- User mentions "Alibaba Cloud OSS" / "Object Storage Service" / "对象存储" / "OSS" / "存储空间" / "Bucket"
- Task involves creating, configuring, listing, or deleting **OSS buckets**
- Task involves **bucket-level features**: ACL, lifecycle, CORS, logging, static website, Referer anti-leech, cross-region replication, bucket policy, encryption, versioning
- Task involves **object operations**: upload, download, copy, move, delete, list, head, restore, presigned URL
- Task involves **multipart uploads**, large file transfers, or resumable uploads
- Task involves **image processing** via `?x-oss-process=` query parameters
- Task involves **data archiving** (Standard / IA / Archive / ColdArchive) and restoring frozen objects
- Task involves **S3-compatible** API calls (e.g., migrate from AWS S3 to OSS)
- User mentions: 访问控制, 读写权限, 公共读, 公共读写, 私有, 防盗链, 跨域设置, 静态网站托管, 镜像回源, 跨区域复制, CRR, 事件通知, 图片处理, 缩略图, 数据湖, 冷归档, 解冻, lifecycle, multipart, presign, signature URL, RAM policy
- User asks to deploy, configure, troubleshoot, or monitor OSS **via API, SDK, CLI, ossutil, or automation**

### SHOULD NOT Use This Skill When

- Task is purely billing / account management → `alicloud-billing-ops`
- Task is RAM / permission model only → `alicloud-ram-ops`
- Task is about **NAS file system (NFS/SMB)** → NAS skill (not yet present)
- Task is about **block storage / EBS disks** → `alicloud-ecs-ops`
- Task is about **CDN edge delivery only** (OSS is just origin) → CDN skill
- Task is about **HDFS / Data Lake Analytics** storage backend → data analytics skill
- User insists on **console-only** flows with no API → state limitation

## Delegation Rules

| 能力 | 委托目标 | 说明 |
|------|----------|------|
| GCL 质量门禁 | `alicloud-gcl-runner-ops` | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

## Five Core Standards (Quality Gates)

| # | Standard | How This Skill Fulfills It |
|---|----------|---------------------------|
| 1 | **Clear Boundaries** | SHOULD/SHOULD NOT conditions with precise triggers; explicit delegation to RAM/CDN/SLS skills |
| 2 | **Structured I/O** | `{{env.*}}` / `{{user.*}}` / `{{output.*}}` placeholders; control-plane + data-plane paths documented |
| 3 | **Explicit Actionable Steps** | Every operation follows Pre-flight → Execute → Validate → Recover pattern (see [CLI](references/cli-usage.md) and [API & SDK](references/api-sdk-usage.md)) |
| 4 | **Complete Failure Strategies** | Error taxonomy ≥ 15 codes; HALT vs retry per type (see [Troubleshooting](references/troubleshooting.md)) |
| 5 | **Absolute Single Responsibility** | One product (OSS), one primary resource (Bucket + Object); CDN/RAM delegated |

### Well-Architected Framework Integration

| Pillar | Skill Integration | Reference |
|--------|-------------------|-----------|
| **安全 (Security)** | Bucket ACL, RAM Policy, Referer, encryption (SSE-KMS/SSE-OSS), presigned URL | [Well-Architected](references/well-architected-assessment.md) §2.1 |
| **稳定 (Stability)** | Cross-region replication, versioning, lifecycle, multi-AZ durability | [Well-Architected](references/well-architected-assessment.md) §2.2 |
| **成本 (Cost)** | Storage class selection, lifecycle tier-down, request cost | [Well-Architected](references/well-architected-assessment.md) §2.3 |
| **效率 (Efficiency)** | Multipart upload, ossutil, parallel transfer, image processing, batch operations | [Well-Architected](references/well-architected-assessment.md) §2.4 |
| **性能 (Performance)** | CDN integration, transfer acceleration, max-PUT-object size (48.8 TB), QPS limits | [Well-Architected](references/well-architected-assessment.md) §2.5 |

## Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action |
|-------------|---------|--------------|
| `{{env.ALIBABA_CLOUD_ACCESS_KEY_ID}}` | Alibaba Cloud AK | NEVER ask the user; fail if unset |
| `{{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}}` | Alibaba Cloud SK | NEVER ask the user; fail if unset |
| `{{env.ALIBABA_CLOUD_REGION_ID}}` | Default region | Use documented default only if skill explicitly allows |
| `{{user.region}}` | User-supplied region (e.g., `cn-hangzhou`) | Ask once; reuse |
| `{{user.bucket_name}}` | Bucket name (3-63 chars, lowercase, no underscores) | Ask once; validate via `validate_oss_bucket_name` |
| `{{user.object_key}}` | Object key (full path within bucket) | Ask once; validate via `validate_oss_object_key` |
| `{{user.storage_class}}` | `Standard` / `IA` / `Archive` / `ColdArchive` / `DeepColdArchive` | Ask once; default `Standard` |
| `{{user.acl}}` | `private` / `public-read` / `public-read-write` | Ask once; default `private` |
| `{{user.endpoint}}` | OSS endpoint (e.g., `oss-cn-hangzhou.aliyuncs.com`) | Derive from region or ask |
| `{{user.local_path}}` | Local file path for upload/download | Ask once |
| `{{output.bucket_name}}` | From last API response | Parse from `$.Bucket.Name` or `$.Buckets[].Name` |
| `{{output.object_etag}}` | Object ETag from response | Parse from `$.ETag` or response header |
| `{{output.request_id}}` | Request ID for support / correlation | Parse from `$.RequestId` |

> **`{{env.*}}` MUST NOT** be collected from the user. **`{{user.*}}`** MUST be collected interactively when missing.
>
> **凭据安全（强制）：** 参考 [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

### Defensive Validation (MANDATORY — Before Every Bucket/Object Operation)

Before executing ANY operation that takes a `Bucket` or `Object Key` parameter, the Agent **MUST** run:

```bash
# Source validation helpers from cli-usage.md
# validate_oss_bucket_name  — exits 0 on valid, non-zero with specific error
# validate_oss_object_key  — exits 0 on valid, non-zero with specific error

if ! validate_oss_bucket_name "{{user.bucket_name}}"; then
  echo "[HALT] Bucket name validation failed — fix the name and retry."
  exit 1
fi

if ! validate_oss_object_key "{{user.object_key}}"; then
  echo "[HALT] Object key validation failed — fix the key and retry."
  exit 1
fi
```

> Full validation functions (with exit code reference 10-15 for bucket, 30-32 for object key) at [CLI Usage → Defensive Validation Helpers](references/cli-usage.md#defensive-validation-helpers).

## API & Response Conventions (Agent-Readable)

- **OpenAPI reference:** `https://help.aliyun.com/zh/oss/developer-reference/api-oss-2019-05-17-overview`
- **Errors:** OSS uses `Code` and `Message` in error response body + HTTP status. See [Troubleshooting](references/troubleshooting.md) for ≥15 error codes.
- **Timestamps:** ISO 8601 with timezone (e.g., `2026-04-28T10:00:00+08:00`).
- **Idempotency:** Object uploads use `ETag` for verification. Multipart uploads use `uploadId` for resumption.
- **Data plane vs control plane:** Control plane via `ossutil` / wrapper; data plane via REST against `./` (S3-compatible signature v4 when enabled).

### Key Response Fields

| Operation | Key JSON Paths |
|-----------|---------------|
| ListBuckets | `$.Buckets[].{Name,Region,StorageClass,CreationDate}` |
| GetBucketInfo | `$.Bucket.{Name,StorageClass,CreationDate,ExtranetEndpoint,IntranetEndpoint,Owner.Id,Versioning}` |
| GetBucketAcl | `$.AccessControlList.Grant` → `private` / `public-read` / `public-read-write` |
| GetBucketLifecycle | `$.LifecycleRules.LifecycleRule[].{Id,Status,Expiration.Days,Transition.Days}` |
| GetBucketReplication | `$.ReplicationConfiguration.Rules.ReplicationRule[].{ID,Destination.Bucket,Status}` |
| ListObjects | `$.Contents[].{Key,Size,ETag,LastModified,StorageClass}` |
| GetBucketStat | `$.{Storage,ObjectCount,MultipartUploadCount}` |

Full response schemas → [API & SDK Usage](references/api-sdk-usage.md).

### Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait |
|-----------|---------------|--------------|---------------|----------|
| PutBucket | absent | exists in `GetBucketInfo` | 3s | 60s |
| DeleteBucket | exists, empty | absent (`NoSuchBucket`) | 3s | 60s |
| PutObject (small) | absent | exists (`HeadObject` 200) | n/a | sync |
| PutObject (large, multipart) | absent | exists after `CompleteMultipartUpload` | 5s | 3600s |
| RestoreObject (Archive) | Archive | Restored (`ongoing-request="false"`) | 30s | 14400s |
| RestoreObject (ColdArchive) | ColdArchive | Restored | 30s | 86400s |
| PutBucketReplication | n/a | `active` | 30s | 600s |

## Execution Flows (Agent-Readable)

Every operation follows: **Pre-flight → Execute → Validate → Recover**.

> **EXECUTION MANDATORY RULE:** 所有 CLI 步骤优先通过 `./scripts/oss-skillopt-wrapper.sh` 运行；wrapper 不可用时降级到 `ossutil`；ossutil 无法覆盖的操作使用 OSS Go SDK V2。参考 `## Runtime Rules`。

### Operation Index

| # | Operation | Tool Path | Key Variables | Reference |
|---|-----------|-----------|---------------|-----------|
| 1 | **Validate Bucket Name** | Bash helper | `{{user.bucket_name}}` | [CLI → Defensive Validation](references/cli-usage.md#defensive-validation-helpers) |
| 2 | **Validate Object Key** | Bash helper | `{{user.object_key}}` | [CLI → Defensive Validation](references/cli-usage.md#defensive-validation-helpers) |
| 3 | **List Buckets** | Wrapper: `./scripts/oss-skillopt-wrapper.sh ls` · Fallback: `ossutil ls` | — | [CLI](references/cli-usage.md#command-map--ossutil-data-plane) |
| 4 | **Create Bucket** | Wrapper: `./scripts/oss-skillopt-wrapper.sh mb oss://{{user.bucket_name}} --storage-class "{{user.storage_class|Standard}}" --acl "{{user.acl|private}}"` · Fallback: `ossutil mb` | `{{user.bucket_name}}`, `{{user.storage_class}}`, `{{user.acl}}` | [CLI](references/cli-usage.md#command-map--ossutil-data-plane) |
| 5 | **Delete Bucket** | Wrapper: `./scripts/oss-skillopt-wrapper.sh rm oss://{{user.bucket_name}}` · Fallback: `ossutil rm` | `{{user.bucket_name}}` | [CLI](references/cli-usage.md#command-map--ossutil-data-plane) |
| 6 | **Get Bucket Info** | Wrapper: `./scripts/oss-skillopt-wrapper.sh stat oss://{{user.bucket_name}}` · Fallback: `ossutil stat` | `{{user.bucket_name}}` | [CLI](references/cli-usage.md#command-map--ossutil-data-plane) |
| 7 | **Get/Set Bucket ACL** | Wrapper: `./scripts/oss-skillopt-wrapper.sh stat` (get) / `set-acl` (set) · Fallback: `ossutil stat` / `ossutil set-acl` | `{{user.bucket_name}}`, `{{user.acl}}` | [CLI](references/cli-usage.md#command-map--ossutil-data-plane) |
| 8 | **Get/Set Bucket Lifecycle** | OSS Go SDK V2 (`GetBucketLifecycle` / `PutBucketLifecycle`) | `{{user.bucket_name}}`, lifecycle rules JSON | [API & SDK](references/api-sdk-usage.md#sdk-operations-map-control-plane-openapi-2019-05-17) |
| 9 | **Get/Set Bucket Referer** | OSS Go SDK V2 (`GetBucketReferer` / `PutBucketReferer`) | `{{user.bucket_name}}`, referer config JSON | [API & SDK](references/api-sdk-usage.md#sdk-operations-map-control-plane-openapi-2019-05-17) |
| 10 | **Get/Set Bucket CORS** | OSS Go SDK V2 (`GetBucketCors` / `PutBucketCors`) | `{{user.bucket_name}}`, CORS config JSON | [API & SDK](references/api-sdk-usage.md#sdk-operations-map-control-plane-openapi-2019-05-17) |
| 11 | **Get/Set Bucket Logging** | OSS Go SDK V2 (`GetBucketLogging` / `PutBucketLogging`) | `{{user.bucket_name}}`, logging config JSON | [API & SDK](references/api-sdk-usage.md#sdk-operations-map-control-plane-openapi-2019-05-17) |
| 12 | **Get/Set Static Website** | OSS Go SDK V2 (`GetBucketWebsite` / `PutBucketWebsite`) | `{{user.bucket_name}}`, website config JSON | [API & SDK](references/api-sdk-usage.md#sdk-operations-map-control-plane-openapi-2019-05-17) |
| 13 | **Get/Set CRR** | OSS Go SDK V2 (`GetBucketReplication`

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [buhaiqing](https://github.com/buhaiqing)
- **Source:** [buhaiqing/aliyun-skills](https://github.com/buhaiqing/aliyun-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-buhaiqing-aliyun-skills-alicloud-oss-ops
- Seller: https://agentstack.voostack.com/s/buhaiqing
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.