OSS Image Processing Diagnosis

Diagnose Alibaba Cloud OSS image processing (IMG) problems: "my x-oss-process URL returns BadRequest", "the image style is not working after I saved it", "why does my browser download the image instead of previewing it", "adding a watermark is not applied to the output", "original image protection returns 403".

Core approach: validate the x-oss-process parameter string offline against the official syntax and value ranges, then verify the source object with the three-step SOP - declared Content-Type (mime type), object size against the official 20 MB limit, and magic-number bytes of the file head - and finally probe a rendering with a read-only GET carrying the rendering query. Attribute "processing not effective" to a concrete cause (unsupported source format, size beyond the limit, invalid parameters, missing object, original-image protection 403, default-domain forced download). Conclude with evidence-based findings only; this skill never changes anything.

Absolute Rules

1. ABSOLUTE PROHIBITION (read-only enforcement): Under NO circumstances may you generate, write, or execute any command/script calling a mutating OSS API - any object upload, deletion, ACL change, style creation/update, or bucket configuration change. This includes commands "for the user to run manually". If the user asks to create or change an image style, only output manual console guidance and declare this skill is read-only.
2. MANDATORY entry-point enforcement: All diagnostics MUST be performed by running the scripts under scripts/ (image_processing_diagnosis.py as the entry, sts_token.py for identity). The Agent is forbidden from assembling its own ossutil / SDK / curl commands against OSS or bypassing the scripts - the scripts embed timeout, error degradation, and observability guarantees that ad-hoc commands lack. Read the script output, interpret it, and compose the report; do not re-implement the queries.
3. ABSOLUTE PROHIBITION (credential handling): Never read, print, or pass AK/SK/STS tokens explicitly. The OSS SDK resolves credentials exclusively from the environment variables of the default credential chain; the identity check uses the aliyun CLI default credential chain. Never accept AK/SK from the user or from another script.
4. NO FABRICATION: Every conclusion must be grounded in data actually returned by the scripts (HeadObject metadata, GET probe headers, magic bytes, GetBucketInfo). If a query fails or returns empty, record it and state the limitation - never invent formats, sizes, or error causes.
5. EXECUTION RULE FOR ERRORS: On any API error, log [WARN] <category>: <message> to stderr, continue with the remaining steps, and still produce the final report with STATUS: DEGRADED and a NEXT_ACTION line - never silently skip or abort without a report.
6. SCOPE BOUNDARY: This skill only answers image-processing attribution questions (parameter syntax, source format/size verification, rendering failures, preview vs download, original-image protection). It does NOT handle video processing, blind watermarking (invisible watermark) or document preview (these belong to IMM intelligent media), CDN domain configuration (CDN cache effects are knowledge-level notes only), or billing - for such requests, state the boundary and give manual guidance only.

Official Doc Verification