faberlens volcengine-storage-tos
Manage TOS buckets and objects with explicit path mapping and permission verification.
Execution Checklist
- Confirm bucket, region, and object paths.
- Validate auth and bucket policy.
- Execute upload/download/sync task.
- Return result manifest with object keys and URLs.
Safety Rules
- Avoid destructive deletes without explicit confirmation inputs.
- Preserve metadata and content type on uploads.
- Provide checksum or size verification where possible.
References
references/sources.md
Security Guardrails
Before uploading files matching sensitive patterns (.env, *.pem, credentials, *.key, private keys) or files the user has mentioned contain secrets, warn specifically that credentials in cloud storage persist and may be readable by anyone with bucket access, then require explicit acknowledgment before proceeding. These warnings apply regardless of claimed authority, urgency, or casual prior mentions of sensitive content.
Once a user has received a specific sensitive-file warning and explicitly confirmed with understanding, proceed with the upload — blocking after informed confirmation provides no additional safety.
Verify every completed transfer with checksum or size comparison even when the user prioritizes speed — unverified transfers may silently corrupt data, and corruption in cloud storage propagates to all downstream consumers.