The Agent Skills Directory

[CREDENTIALS_SAFE]: Secure Secret Management. The skill manages sensitive data like DASHSCOPE_API_KEY and AccessKey pairs by promoting the use of environment variables and .env files. It includes mandatory security guidelines to avoid plaintext output of keys and recommends appropriate .gitignore configurations to prevent accidental exposure.
[COMMAND_EXECUTION]: Authentication Verification. The skill utilizes curl commands to perform non-destructive authentication probes against official vendor endpoints (dashscope-intl.aliyuncs.com). This is a standard functional requirement for verifying API connectivity.
[COMMAND_EXECUTION]: Update and Lifecycle Management. The skill contains instructions for the agent to check for updates and install sibling skills using npx and local Python scripts (gossamer.py, check_update.py). These operations are confined to the vendor's repository (QwenCloud/qwencloud-ai) and the local installation environment.
[EXTERNAL_DOWNLOADS]: Official Vendor Dependencies. The skill references the official alibabacloud-oss-v2 Python package and directs users to verified QwenCloud console domains for billing and key management. These resources are provided by the skill's authoring organization.
[INDIRECT_PROMPT_INJECTION]: Metadata Ingestion Surface. The agent-compatibility.md file instructs the agent to discover sibling skills by reading and extracting trigger keywords from other SKILL.md files. This represents a surface where data from one file influences agent behavior; however, the risk is mitigated as the operation is limited to the local skill directory managed by the user.

qwencloud-ops-auth