Alibabacloud Oss Manage Cron Upload

OSS Scheduled Local Sync

Plan and validate scheduled local-folder-to-OSS uploads with an aliyun-CLI-first workflow.

Scenario Description

This skill covers the case where a local folder changes over time and must be uploaded to OSS on a recurring schedule.

Architecture: Local folder + aliyun CLI (integrated ossutil) + cron/Task Scheduler + OSS Bucket

Capability split:

• [aliyun CLI] installation checks, profile verification, command discovery, OSS-side verification, and integrated aliyun ossutil upload/list commands.
• [OS-local] cron or Windows Task Scheduler configuration.
• [Manual/Console] RAM policy attachment and optional visual verification in the OSS Console.

Installation

Pre-check: Aliyun CLI >= 3.3.3 required

Run aliyun version to verify >= 3.3.3. If not installed or version too low,

see references/cli-installation-guide.md for installation instructions.

Then run aliyun configure set --auto-plugin-install true.

At the start of the Core Workflow (before any CLI invocation):

[MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution.

Run the following commands before any CLI invocation:

```bash

aliyun configure ai-mode enable

aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload"

```

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed.

AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

```bash

aliyun configure ai-mode disable

```

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include:

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Required local tools:

Use references/cli-installation-guide.md only for CLI installation and plugin setup. For this skill, use the integrated aliyun ossutil command surface — do not require standalone ossutil installation or bare ossutil commands.

Environment Variables

No extra cloud-specific environment variables are required beyond an already configured Alibaba Cloud profile.

Optional local variables used in examples:

Parameter Confirmation

Parameter Extraction — Extract all user-customizable parameters directly from the user's request.

When the user's message already specifies values (such as region, bucket name, paths, schedule, or MaxAge),

use those values directly without asking for re-confirmation.

Only ask the user for clarification when a required parameter is genuinely missing from their request

and cannot be reasonably inferred from context.

Input Validation — All parameters must be validated before use.

Treat all inputs (including values extracted from user messages) as untrusted. Before substituting any parameter into a shell command:

1. Validate the value against the Validation Pattern column above. Reject values that do not match.

2. BucketName must contain only lowercase letters, digits, and hyphens ([a-z0-9-]), be 3–63 characters, and must not start or end with a hyphen.

3. RegionId must match the Alibaba Cloud region format (e.g., cn-hangzhou, us-west-1, ap-southeast-5).

4. MaxAge must be a positive integer followed by d (days), h (hours), or m (minutes).

5. LocalSourcePath, AliyunBinaryPath, and LogPath must be absolute paths and must not contain shell metacharacters ($, ` `, $(, ;, |, &, >, <, \n`).

6. TargetOssPrefix must contain only alphanumeric characters, /, _, ., and -, and must not start with /.

7. If any parameter fails validation, stop and report the error to the user. Do not attempt to sanitize or escape invalid values — reject them outright.

Authentication

Pre-check: Alibaba Cloud Credentials Required

>

Security Rules:

- NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)

- NEVER read or cat credential files such as ~/.aliyun/config.json, ~/.ossutil/config, or any file that may contain secrets

- NEVER ask the user to input AK/SK directly in the conversation or command line

- NEVER use aliyun configure set with literal credential values

- ONLY use aliyun configure list to check credential status

>

```bash

aliyun configure list

```

Check the output for a valid profile (AK, STS, or OAuth identity).

>

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console

2. Configure credentials outside of this session (via aliyun configure in terminal or environment variables in shell profile)

3. Return and re-run after aliyun configure list shows a valid profile

Reuse the active CLI profile for all aliyun ossutil commands. Do not print or hardcode secrets. Do not replace this gate with ossutil config or any other secret-entry flow.

RAM Policy

The default workflow needs least-privilege access for bucket discovery, bucket metadata verification, and object upload under the confirmed prefix.

Use references/ram-policies.md for the policy JSON and the prefix-scoped resource examples.

Do not redefine the default minimum set around oss:AbortMultipartUpload. In this skill, the default least-privilege path stays anchored on bucket discovery, bucket metadata verification, and prefix-scoped upload/list/read actions. Multipart-cleanup permissions are follow-up work only when the user explicitly asks for them.

Core Workflow

Execute, don't just document. Run each step's commands directly in the environment. Do not only write solution documents or scripts — actually execute aliyun version, aliyun configure list, aliyun ossutil cp, etc. against the live environment.

>

Extract RegionId, BucketName, TargetOssPrefix, LocalSourcePath, Schedule, MaxAge, OperatingSystem, and BucketAlreadyExists from the user's request. Only ask the user if a required parameter is genuinely missing.

Step 1: Verify CLI and credentials [aliyun CLI]

aliyun version
aliyun configure list
aliyun configure ai-mode enable

Verify that:

• aliyun version is >= 3.3.3
• at least one valid profile is present
• AI safety mode is enabled (dangerous operations will be blocked)

If the version is too low or aliyun is missing, see references/cli-installation-guide.md. Do not work around a missing CLI by switching to standalone ossutil or aliyun ossutil sync.

Step 2: Verify or create the bucket prerequisite [aliyun CLI]

Always start by checking the candidate bucket inventory:

aliyun ossutil api list-buckets --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

If BucketAlreadyExists=yes, verify the selected bucket explicitly:

aliyun ossutil stat "oss://${BucketName}" --region "${RegionId}" --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Cross-region note: When the active CLI profile's region (shown by aliyun configure list) differs from the target bucket's RegionId, you must add --region "${RegionId}" to stat, ls, and cp commands. Using --endpoint alone is insufficient because the request signing region must also match. The --region flag overrides both the endpoint and the signing region in a single step.

What to confirm:

• the bucket name is present in the account inventory
• the bucket region matches RegionId
• the bucket is reachable with the active profile
• if multiple existing buckets can satisfy the same backup target, you can remind the user that a bucket with versioning enabled is preferable for backup safety, but this is only a recommendation and does not block using the confirmed existing bucket

If BucketAlreadyExists=no, use the check-then-act idempotent pattern: 1. First run list-buckets (above) to confirm the bucket truly does not exist in the account — if it already exists, skip creation and go directly to stat verification. 2. Only if the bucket is confirmed absent, create it by following the existing creation flow of this skill. 3. After creation, immediately re-run stat to verify:

aliyun ossutil stat "oss://${BucketName}" --region "${RegionId}" --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Optional recommendation for recurring backup scenarios:

• if multiple candidate buckets exist and one already has versioning enabled, mention that it is preferable for backup rollback safety
• if the confirmed existing bucket does not have versioning enabled, it can still be used for this workflow; enabling versioning is only an optional hardening suggestion, not a prerequisite

Keep aliyun ossutil as the canonical surface for upload and verification commands such as cp, ls, and stat. For bucket creation, follow the existing creation flow already documented by this skill instead of inventing a new command family here. Do not fabricate success, extra deployment files, or fake local artifacts just to cover a missing prerequisite.

Step 3: Run the canonical incremental upload test [aliyun CLI / integrated ossutil]

Use the official data-plane command family for the actual scheduled upload job through aliyun ossutil:

aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" \
  -r -u \
  --max-age "${MaxAge}" \
  --region "${RegionId}" \
  --read-timeout 300 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Key rules for this command:

• -u is mandatory: uploads only when the target object is missing or the source file is newer than the existing OSS object
• -r -u --max-age must stay together as the canonical flag set
• --region "${RegionId}" ensures both endpoint and signing region are correct
• --read-timeout 300 --connect-timeout 30 prevents the command from hanging indefinitely; adjust --read-timeout upward for very large files if needed
• Add -f only for unattended runs (cron, Task Scheduler, CI)
• Use absolute paths for LocalSourcePath (never ~)
• Normalize TargetOssPrefix without a leading /
• Do not substitute with bare ossutil, aliyun ossutil sync, or Cache-Control metadata rewrites

If TargetOssPrefix is empty, use oss://${BucketName}/ (with trailing slash). Otherwise use oss://${BucketName}/${TargetOssPrefix} after prefix normalization.

If `LocalSourcePath` does not exist in the current environment (e.g., container or CI runner), create it under the current working directory with a small test file, then run the upload command against it and verify with aliyun ossutil ls. This proves the upload path works end-to-end. Do not skip the upload test just because the directory is absent — create it and validate connectivity, permissions, and command correctness:

```bash

mkdir -p "${LocalSourcePath}" && echo "test" > "${LocalSourcePath}/test.txt"

aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" \

-r -u --max-age "${MaxAge}" --region "${RegionId}" \

--read-timeout 300 --connect-timeout 30 \

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" \

--read-timeout 60 --connect-timeout 30 \

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

```

Step 4: Wrap the upload in a local script [aliyun CLI + OS-local]

Minimal script template:

#!/usr/bin/env bash
set -euo pipefail

ALIYUN_BIN="${ALIYUN_BIN:-aliyun}"
LOCAL_SOURCE_PATH="${LocalSourcePath}"   # MUST be an absolute path, never use ~
BUCKET_NAME="${BucketName}"
TARGET_OSS_PREFIX="${TargetOssPrefix#/}"
MAX_AGE="${MaxAge}"
REGION_ID="${RegionId}"
LOG_FILE="${OSS_SYNC_LOG:-$HOME/oss-sync.log}"
READ_TIMEOUT="${READ_TIMEOUT:-600}"
CONNECT_TIMEOUT="${CONNECT_TIMEOUT:-30}"

# --- Input validation ---
[[ "${BUCKET_NAME}" =~ ^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$ ]] || { echo "ERROR: Invalid BucketName: ${BUCKET_NAME}" >&2; exit 1; }
[[ "${REGION_ID}" =~ ^[a-z]{2}-[a-z]+(|-[0-9]+)$ ]]          || { echo "ERROR: Invalid RegionId: ${REGION_ID}" >&2; exit 1; }
[[ "${MAX_AGE}" =~ ^[0-9]+[dhm]$ ]]                           || { echo "ERROR: Invalid MaxAge: ${MAX_AGE}" >&2; exit 1; }
[[ "${TARGET_OSS_PREFIX}" =~ ^[A-Za-z0-9/_.-]*$ ]]            || { echo "ERROR: Invalid TargetOssPrefix: ${TARGET_OSS_PREFIX}" >&2; exit 1; }
[[ "${LOCAL_SOURCE_PATH}" == /* ]]                             || { echo "ERROR: LocalSourcePath must be absolute: ${LOCAL_SOURCE_PATH}" >&2; exit 1; }

TARGET_URI="oss://${BUCKET_NAME}/"

if [ -n "${TARGET_OSS_PREFIX}" ]; then
  TARGET_URI="oss://${BUCKET_NAME}/${TARGET_OSS_PREFIX}"
fi

"${ALIYUN_BIN}" ossutil cp "${LOCAL_SOURCE_PATH}" "${TARGET_URI}" \
  -r -u -f \
  --max-age "${MAX_AGE}" \
  --region "${REGION_ID}" \
  --read-timeout "${READ_TIMEOUT}" --connect-timeout "${CONNECT_TIMEOUT}" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload >> "${LOG_FILE}" 2>&1

Note: The -f flag is included in the script template because the script is intended for unattended cron/Task Scheduler execution where interactive prompts must not block the job. The --region flag is preferred over --endpoint because it sets both the endpoint and signing region correctly, which is required when the CLI profile's default region differs from the target bucket's region.

Step 5: Configure the scheduler [OS-local]

Linux/macOS cron:

For the default Linux/macOS path in this skill, keep cron / crontab as the documented scheduler surface. Do not silently swap the answer to launchd unless the user explicitly asks for a launchd-specific variant.

If `crontab` is not found: In container or minimal environments, crontab may not be pre-installed. Install the cronie package first:

- CentOS/Alibaba Cloud Linux/RHEL: yum install -y cronie

- Debian/Ubuntu: apt-get install -y cron

>

If systemctl start crond fails (e.g., no systemd in containers), you can still add cron entries via crontab — the cron daemon is not strictly required for entry registration, only for actual execution. In such cases, document the cron entry for the user to deploy on their production host, and do not let the missing daemon block the rest of the workflow.

crontab -e

Example entry (use echo ... | crontab - for non-interactive installation):

0 3 * * * /usr/local/bin/oss-sync-upload.sh >> /var/log/oss-sync-cron.log 2>&1

Windows Task Scheduler via local CLI:

schtasks /Create /SC DAILY /ST 03:00 /TN "OSS Scheduled Sync" /TR "C:\tools\oss-sync-upload.bat"

Label this step clearly as OS-local. It is not an Alibaba Cloud API action. Keep the scheduler output minimal and directly actionable; do not explode this step into extra README files, XML exports, PowerShell wrappers, demo payloads, or other auxiliary artifacts unless the user explicitly asks for them.

Step 6: Verify the upload target [aliyun CLI / integrated ossutil]

Always run this verification after any upload (including test uploads from Step 3):

aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Confirm that the expected objects appear under the target prefix. Do not skip this step — it proves end-to-end connectivity and permissions.

If the user wants a manual visual check, label it clearly as [Manual/Console] and confirm the target prefix in the OSS Console.

Step 7: State the capability boundary clearly

Always state these limitations when relevant:

• The actual incremental sync step runs through `aliyun ossutil`. This skill stays on the aliyun CLI surface and does not require a separate standalone ossutil installation.
• Scheduler setup is OS-local. Cron and Task Scheduler are configured on the host OS, not through Alibaba Cloud APIs.
• RAM policy attachment is typically manual or follows the user's existing IAM workflow.
• Bucket creation should happen before scheduled upload when the target bucket is missing. Follow the existing creation flow of this skill for that prerequisite.
• If multiple equivalent existing buckets are available, it is fine to remind the user that a versioning-enabled bucket is preferable for backup safety. If no versioned bucket is available, continue with the confirmed existing bucket instead of blocking the workflow.
• Optional OSS Console checks are manual.
• Do not simulate success. When a prerequisite is missing, say so plainly instead of creating fake local test data, pretend execution logs, or extra packaging artifacts.

Success Verification Method

Use references/verification-method.md as the authoritative checklist.

Minimum pass conditions: 1. aliyun configure list shows a valid profile. 2. aliyun ossutil cp --help succeeds. 3. the canonical aliyun ossutil cp ... -r -u --max-age ... --region ... command completes without permission or endpoint errors. 4. aliyun ossutil ls ... --region ... shows the expected uploaded objects under the confirmed prefix. 5. the upload command keeps -u, meaning it uploads only when the target object is missing or the local source file is newer than the existing OSS object. 6. the local scheduler entry is visible through crontab -l or Task Scheduler history/query, or is documented for the user when crontab is not available in the current environment.

Cleanup

Cleanup is optional because this skill is intended for recurring sync, but test artifacts and scheduler entries can be removed safely.

Linux/macOS cron [OS-local]:

• remove the cron line with crontab -e
• delete the local script and log file only if the user explicitly wants rollback

Windows Task Scheduler [OS-local]:

schtasks /Delete /TN "OSS Scheduled Sync" /F

Optional OSS test cleanup [aliyun CLI / integrated ossutil]:

aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt" --region "${RegionId}" \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Do not delete the bucket or production objects unless the user explicitly asks for that cleanup scope.

Disable AI safety mode [aliyun CLI]:

After all tasks are completed, disable AI safety mode to restore normal CLI behavior:

aliyun configure ai-mode disable

API and Command Tables

See references/related-apis.md for the command inventory, OSS capability notes, and validation notes. That file is reference metadata only.

Best Practices

1. Keep aliyun for pre-checks, command discovery, bucket verification, and integrated aliyun ossutil cp for the actual scheduled upload. 2. Use --region "${RegionId}" on all aliyun ossutil commands (stat, cp, ls, rm) to ensure both endpoint and signing region are correct. This is especially important when the CLI profile's default region differs from the target bucket's region. Do not rely on --endpoint alone, as it does not override the signing region and will fail with "Invalid signing region in Authorization header" errors when using STS tokens across regions. 3. Keep scheduler steps labeled as OS-local so the user understands they are outside Alibaba Cloud APIs. 4. Use the narrowest RAM policy possible: bucket inventory at account scope, bucket info on the target bucket, and object upload only on the confirmed prefix. 5. Run aliyun version and aliyun configure list on the target machine before live execution. 6. Never print AK/SK values, never hardcode them in scripts, never read credential files like ~/.aliyun/config.json, and never replace the credential gate with inline secret handling. 7. If the bucket does not exist, create it first before configuring scheduled upload. If multiple existing buckets can satisfy the same backup target, you may remind the user that a versioning-enabled bucket is preferable for backup safety, but if no such bucket exists, continue with the confirmed existing bucket. 8. Always use absolute paths for LocalSourcePath in commands and scripts. Do not use ~ (tilde) because it may not expand inside quoted strings, causing "not a directory" errors. 9. In generated scripts intended for cron or Task Scheduler, include the -f flag to prevent interactive confirmation prompts from blocking unattended execution.

Reference Links

Acceptance Criteria: alibabacloud-oss-manage-cron-upload

Scenario: Scheduled incremental sync from a local folder to OSS Purpose: Verify that the skill stays aliyun-CLI-first, preserves the canonical aliyun ossutil cp upload command, and clearly labels manual or OS-local steps.

---

Correct CLI Command Patterns

1. Aliyun plugin-mode command shape

✅ CORRECT

aliyun oss --help
aliyun ossutil api list-buckets --output-format json --user-agent AlibabaCloud-Agent-Skills
aliyun ossutil stat "oss://example-bucket" --output-format json --user-agent AlibabaCloud-Agent-Skills

Why it is correct:

• product and subcommands are lowercase plugin-mode commands
• every live aliyun command stays on the aliyun CLI surface documented by this skill

❌ INCORRECT

aliyun OSS Help
aliyun ossutil api ListBuckets
aliyun ossutil stat "oss://example-bucket"

Why it is incorrect:

• uses non-plugin command shapes or mixed casing
• drifts away from the documented CLI form

2. Credential verification gate

✅ CORRECT

aliyun configure list

Why it is correct:

• verifies profile availability without printing secrets
• matches the skill's safe authentication rule

❌ INCORRECT

echo "$ALIBABA_CLOUD_ACCESS_KEY_ID"
aliyun configure set --access-key-id YOUR_ID --access-key-secret YOUR_SECRET

Why it is incorrect:

• prints or inlines credentials
• bypasses the required credential gate

3. Canonical incremental upload command

✅ CORRECT

aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" \
  -r -u \
  --max-age "${MaxAge}" \
  --region "${RegionId}" \
  --read-timeout 300 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills

Why it is correct:

• keeps the official ossutil cp workflow through aliyun CLI
• keeps the canonical incremental flags together
• -u means upload only when the target object is missing or the local source file is newer than the existing OSS object
• -f is optional and should be added only for explicitly requested non-interactive unattended runs such as cron, Task Scheduler, or CI
• --region sets both the endpoint and signing region correctly, which is required when the CLI profile's default region differs from the target bucket's region
• assumes a bucket-relative target prefix rather than an absolute OSS path

Using --endpoint "oss-${RegionId}.aliyuncs.com" in addition to --region is also acceptable but not required, since --region alone is sufficient and handles cross-region signing correctly.

❌ INCORRECT

ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" -r -u --max-age "${MaxAge}" --endpoint "oss-${RegionId}.aliyuncs.com"
ossutil config
aliyun ossutil sync "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}"
aliyun oss sync "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}"
aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" -r -u --endpoint "https://oss-${RegionId}.aliyuncs.com"
aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" --recursive --update --meta "Cache-Control:max-age=604800"
aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" -r -u
aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" -r -u --endpoint "oss-${RegionId}.aliyuncs.com"
cat ~/.aliyun/config.json

Why it is incorrect:

• uses bare ossutil instead of the integrated aliyun ossutil surface required by this skill
• reintroduces ossutil config, which this skill must not use as the in-session auth flow
• replaces the documented cp workflow with sync
• omits --max-age
• rewrites the requested incremental window into unrelated object metadata
• uses https:// prefix in endpoint which is not the documented format
• uses only --endpoint without --region, which fails with "Invalid signing region" when the CLI profile region differs from the target bucket region (STS token signing mismatch)
• omits both --max-age and --region
• reads credential files directly, exposing AK/SK values

4. Bucket prerequisite and versioning preference

✅ CORRECT

Use the existing bucket-creation flow documented by this skill, then continue with the verified `aliyun ossutil` upload path.

Why it is correct:

• if the bucket is missing, it is created before scheduled upload is configured
• if the bucket already exists, the answer may mention that versioning is preferable for backup safety, but does not block the workflow when no versioned bucket is available
• keeps bucket-management guidance on the aliyun CLI surface instead of drifting to unrelated tools

❌ INCORRECT

When the bucket is missing, stop permanently and refuse to show any bucket-creation path.
Never mention that bucket versioning can be beneficial for recurring backup scenarios even when the user asks for safer rollback options.
Treat a non-versioned existing bucket as unusable and block the workflow even though the user already confirmed that bucket.

Why it is incorrect:

• leaves the workflow incomplete when the missing-bucket step can be handled first
• drops a key backup-safety preference for recurring sync scenarios
• fails to encode the repository's new bucket-selection priority

5. Integrated ossutil through aliyun CLI

✅ CORRECT

Use aliyun CLI for installation checks, credential verification, help discovery, bucket verification, and the `aliyun ossutil cp` scheduled upload command.

Why it is correct:

• matches the user's CLI-only requirement for this skill
• keeps the upload flow on the integrated aliyun ossutil surface

❌ INCORRECT

Require a separate standalone `ossutil` installation or document bare `ossutil` commands as the primary path for this skill.
Tell the user to run `brew install ossutil` or `ossutil config` for the default workflow.

Why it is incorrect:

• drifts away from the required aliyun CLI surface
• reintroduces a separate local dependency that this skill should avoid
• swaps the required aliyun configure list gate for an unsupported credential flow

6. Scheduler labeling

✅ CORRECT

[OS-local] Configure cron with crontab or configure Windows Task Scheduler with schtasks or the Task Scheduler UI.

Why it is correct:

• labels the scheduler as host-level configuration
• makes it clear this is outside Alibaba Cloud APIs

❌ INCORRECT

Use aliyun CLI to create the cron job in OSS.
Use launchd as the default macOS answer even though the requested skill flow is documented around cron.

Why it is incorrect:

• misclassifies local scheduler setup as a cloud API operation
• drifts away from the skill's documented cron-first macOS path

7. Manual and unvalidated steps

✅ CORRECT

If the bucket is missing, create it first through the existing creation flow of this skill. If the bucket already exists, it is fine to mention that a versioning-enabled bucket is preferable for backup safety, but the confirmed existing bucket can still be used directly.

Why it is correct:

• avoids inventing unverified commands
• keeps the user informed about capability boundaries

❌ INCORRECT

Claim that bucket creation, RAM policy attachment, and scheduler setup are fully validated in this repository even though aliyun was not installed locally.
Mark the normal `aliyun ossutil cp ... --max-age ...` upload flow itself as unvalidated and replace it with a placeholder-only local filtering script.
Generate fake success artifacts such as sample upload logs, demo test files, or placeholder execution traces when the real prerequisite is still missing.

Why it is incorrect:

• overstates what was actually verified
• hides important operational limits
• blurs the line between truly unvalidated steps and the canonical upload pattern already required by the skill
• encourages simulated success instead of accurate boundary reporting

---

Validation Checklist

The generated skill passes only if all of the following are true: 1. every live aliyun command shown by the skill stays on the documented aliyun CLI surface 2. the credential gate uses aliyun configure list rather than printing or setting secrets inline 3. the scheduled upload step uses aliyun ossutil cp with -r -u --max-age 4. the answer explains that -u uploads only when the target object is missing or the local source file is newer than the existing OSS object 5. if -f is mentioned, it is framed only as an optional flag for explicitly requested non-interactive unattended runs 6. the endpoint format is oss-${RegionId}.aliyuncs.com without https:// 7. scheduler setup is labeled OS-local 8. if the bucket is missing, the answer creates it first following the existing creation flow of this skill 9. if the bucket already exists, the answer may mention that a versioned bucket is preferable for backup safety, but does not treat versioning as a hard prerequisite 10. macOS default scheduling guidance stays on cron / crontab unless the user explicitly asks for launchd 11. the answer does not replace the canonical upload command with bare ossutil, ossutil config, Cache-Control metadata mapping, or placeholder-only filtering scripts

Aliyun CLI Installation & Configuration Guide

Complete guide for installing and configuring Aliyun CLI.

Aliyun CLI 3.3.3+: Supports installing and using all published Alibaba Cloud product plugins. Make sure to upgrade to 3.3.3 or later for full plugin ecosystem coverage.

Installation

macOS

Using Homebrew (Recommended)

brew install aliyun-cli
# Upgrade to latest
brew upgrade aliyun-cli

# Verify version (>= 3.3.3)
aliyun version

Using Binary

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-macosx-latest-amd64.tgz

# Extract
tar -xzf aliyun-cli-macosx-latest-amd64.tgz

# Move to PATH
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

Linux

Debian/Ubuntu

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

CentOS/RHEL

# Download
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-amd64.tgz
sudo mv aliyun /usr/local/bin/

# Verify
aliyun version

ARM64 Architecture

# Download ARM64 version
wget https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-arm64.tgz

# Extract and install
tar -xzf aliyun-cli-linux-latest-arm64.tgz
sudo mv aliyun /usr/local/bin/

Windows

Using Binary 1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip 2. Extract the ZIP file 3. Add the directory to your PATH environment variable 4. Open new Command Prompt or PowerShell 5. Verify: aliyun version

Using PowerShell

# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH (requires admin privileges)
$env:Path += ";C:\aliyun-cli"
[Environment]::SetEnvironmentVariable("Path", $env:Path, [System.EnvironmentVariableTarget]::Machine)

# Verify
aliyun version

Configuration

SECURITY WARNING — For human operators only, NOT for agent execution.

The credential configuration examples below are reference documentation for users to run outside of agent sessions. Agents must NEVER execute aliyun configure set with --access-key-id or --access-key-secret flags. During skill execution, agents should ONLY use aliyun configure list to verify that a valid profile already exists.

Quick Start

The user should run the following command outside of the agent session (e.g., in a separate terminal):

aliyun configure set \
  --mode AK \
  --access-key-id <your-access-key-id> \
  --access-key-secret <your-access-key-secret> \
  --region cn-hangzhou

All aliyun configure commands support non-interactive flags, which is the recommended approach — it works in scripts, CI/CD pipelines, and agent-driven automation without hanging on stdin prompts.

Enable AI Safety Mode (Required for agent-driven workflows)

After configuring credentials, enable AI safety mode to prevent dangerous operations:

aliyun configure ai-mode enable

Where to Get Access Keys

1. Log in to Aliyun Console: https://ram.console.aliyun.com/ 2. Navigate to: AccessKey Management 3. Create a new AccessKey pair 4. Save the secret immediately — it's only shown once

Configuration Modes

Aliyun CLI supports 6 authentication modes. All examples below use non-interactive flags.

Note: All credential configuration examples in this section are for human operators to run outside of agent sessions. Agents must NEVER execute these commands.

1. AK Mode (Access Key)

Most common mode for personal accounts and scripts.

aliyun configure set \
  --mode AK \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --region cn-hangzhou \

Configuration is stored in ~/.aliyun/config.json:

{
  "current": "default",
  "profiles": [
    {
      "name": "default",
      "mode": "AK",
      "access_key_id": "LTAI5tXXXXXXXX",
      "access_key_secret": "8dXXXXXXXXXXXXXXXXXXXXXXXX",
      "region_id": "cn-hangzhou",
      "output_format": "json",
      "language": "en"
    }
  ]
}

2. StsToken Mode (Temporary Credentials)

For short-lived access (tokens expire in 1-12 hours).

aliyun configure set \
  --mode StsToken \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --sts-token v1.0:XXXXXXXXXXXXXXXX \
  --region cn-hangzhou \

Use cases: CI/CD pipelines, temporary access for external contractors, cross-account access.

3. RamRoleArn Mode (Assume RAM Role)

Assume a RAM role for elevated or cross-account access.

aliyun configure set \
  --mode RamRoleArn \
  --access-key-id LTAI5tXXXXXXXX \
  --access-key-secret 8dXXXXXXXXXXXXXXXXXXXXXXXX \
  --ram-role-arn acs:ram::123456789012:role/AdminRole \
  --role-session-name my-session \
  --region cn-hangzhou \

Use cases: cross-account resource access, temporary elevated privileges, role-based access control.

4. EcsRamRole Mode (ECS Instance RAM Role)

Use the RAM role attached to an ECS instance — no credentials needed.

aliyun configure set \
  --mode EcsRamRole \
  --ram-role-name MyEcsRole \
  --region cn-hangzhou \

Requirements: must be running on an ECS instance with a RAM role attached.

Use cases: scripts and automation running on ECS instances.

5. RsaKeyPair Mode (RSA Key Pair)

Use RSA key pair for authentication (generate key pair in Aliyun Console first).

aliyun configure set \
  --mode RsaKeyPair \
  --private-key /path/to/private-key.pem \
  --key-pair-name my-key-pair \
  --region cn-hangzhou \

6. RamRoleArnWithEcs Mode (ECS + RAM Role)

Combine ECS instance role with RAM role assumption for cross-account access from ECS.

aliyun configure set \
  --mode RamRoleArnWithEcs \
  --ram-role-name MyEcsRole \
  --ram-role-arn acs:ram::123456789012:role/TargetRole \
  --role-session-name my-session \
  --region cn-hangzhou \

Environment Variables

Highest priority - overrides config file

Access Key Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

STS Token Mode

export ALIBABA_CLOUD_ACCESS_KEY_ID=your_access_key_id
export ALIBABA_CLOUD_ACCESS_KEY_SECRET=your_access_key_secret
export ALIBABA_CLOUD_SECURITY_TOKEN=your_sts_token
export ALIBABA_CLOUD_REGION_ID=cn-hangzhou

ECS RAM Role Mode

export ALIBABA_CLOUD_ECS_METADATA=role_name

Use Case:

• CI/CD pipelines
• Docker containers
• Temporary credential override

Managing Multiple Profiles

Create Named Profiles

aliyun configure set --profile projectA \
  --mode AK \
  --access-key-id LTAI5tAAAAAAAA \
  --access-key-secret 8dAAAAAAAAAAAAAAAAAAAAAAAA \
  --region cn-hangzhou

aliyun configure set --profile projectB \
  --mode AK \
  --access-key-id LTAI5tBBBBBBBB \
  --access-key-secret 8dBBBBBBBBBBBBBBBBBBBBBBBB \
  --region cn-shanghai \

Use Specific Profile

aliyun ecs describe-instances --user-agent AlibabaCloud-Agent-Skills --profile projectA

export ALIBABA_CLOUD_PROFILE=projectA
aliyun ecs describe-instances --user-agent AlibabaCloud-Agent-Skills   # Uses projectA

List and Switch Profiles

aliyun configure list                      # List all profiles
aliyun configure set --current projectA    # Switch default profile

Credential Priority

Credentials are loaded in this order (first found wins):

1. Command-line flag: --profile <name> 2. Environment variable: ALIBABA_CLOUD_PROFILE 3. Environment credentials: ALIBABA_CLOUD_ACCESS_KEY_ID, etc. 4. Configuration file: ~/.aliyun/config.json (current profile) 5. ECS Instance RAM Role: If running on ECS with attached role

Verification

Test Authentication

# Basic test - list regions
aliyun ecs describe-regions --user-agent AlibabaCloud-Agent-Skills

# Expected output: JSON array of regions

If successful, you'll see:

{
  "Regions": {
    "Region": [
      {
        "RegionId": "cn-hangzhou",
        "RegionEndpoint": "ecs.cn-hangzhou.aliyuncs.com",
        "LocalName": "华东 1（杭州）"
      },
      ...
    ]
  },
  "RequestId": "..."
}

If failed, you'll see error messages:

• InvalidAccessKeyId.NotFound - Wrong Access Key ID
• SignatureDoesNotMatch - Wrong Access Key Secret
• InvalidSecurityToken.Expired - STS token expired (for StsToken mode)
• Forbidden.RAM - Insufficient permissions

Debug Configuration

# Show current configuration
aliyun configure get

# Test with debug logging
aliyun ecs describe-regions --user-agent AlibabaCloud-Agent-Skills --log-level=debug

# Check credential provider
aliyun configure get mode

Security Best Practices

1. Use RAM Users (Not Root Account)

❌ Don't: Use Aliyun root account credentials ✅ Do: Create RAM users with specific permissions

# Create RAM user in console
# Attach only necessary policies
# Use RAM user's access keys

2. Principle of Least Privilege

Grant only the minimum permissions needed:

# Example: Read-only ECS access
# Attach policy: AliyunECSReadOnlyAccess

3. Rotate Access Keys Regularly

# Create new access key in RAM Console, then update configuration (run outside of agent session)
aliyun configure set --access-key-id NEW_KEY --access-key-secret NEW_SECRET
# Delete old access key from console

4. Use STS Tokens for Temporary Access

# Run outside of agent session
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token XXXX --region cn-hangzhou

5. Use ECS RAM Roles When Possible

# Run outside of agent session
aliyun configure set --mode EcsRamRole --ram-role-name MyRole --region cn-hangzhou

6. Never Commit Credentials

# Add to .gitignore
echo "~/.aliyun/config.json" >> .gitignore

# Use environment variables in CI/CD instead

7. Secure Config File

# Restrict permissions
chmod 600 ~/.aliyun/config.json

Troubleshooting

Issue: Command Not Found

# Check installation
which aliyun

# Check PATH
echo $PATH

# Reinstall or add to PATH

Issue: Authentication Failed

# Verify configuration
aliyun configure get

# Test with debug
aliyun ecs describe-regions --user-agent AlibabaCloud-Agent-Skills --log-level=debug

# Check credentials in console
# Verify access key is active

Issue: Permission Denied

# Error: Forbidden.RAM

# Check RAM user permissions
# Attach necessary policies in RAM console
# Example: AliyunECSFullAccess for ECS operations

Issue: STS Token Expired

# Error: InvalidSecurityToken.Expired

# Reconfigure with new token (run outside of agent session)
aliyun configure set --mode StsToken \
  --access-key-id XXXX --access-key-secret XXXX \
  --sts-token NEW_TOKEN --region cn-hangzhou

Issue: Wrong Region

# Some resources may not exist in the specified region

# Check available regions
aliyun ecs describe-regions --user-agent AlibabaCloud-Agent-Skills

# Update default region
aliyun configure set region cn-shanghai

Advanced Configuration

Custom Endpoint

# Use custom or private endpoint
export ALIBABA_CLOUD_ECS_ENDPOINT=ecs-vpc.cn-hangzhou.aliyuncs.com

Proxy Settings

# HTTP proxy
export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080

# No proxy for specific domains
export NO_PROXY=localhost,127.0.0.1,.aliyuncs.com

Timeout Settings

# Connection timeout (default: 10s)
export ALIBABA_CLOUD_CONNECT_TIMEOUT=30

# Read timeout (default: 10s)
export ALIBABA_CLOUD_READ_TIMEOUT=30

Next Steps

After installation and configuration:

1. Install plugins for services you need (v3.3.3+ supports all published product plugins):

   aliyun plugin install --names ecs vpc rds

   # List all available plugins
   aliyun plugin list-remote

2. Explore commands:

   aliyun ecs --help
   aliyun fc --help

3. Read documentation:

• Command Syntax Guide
• Global Flags Reference
• Common Scenarios

References

• Official Documentation: https://help.aliyun.com/zh/cli/
• RAM Console: https://ram.console.aliyun.com/
• Access Key Management: https://ram.console.aliyun.com/manage/ak
• Plugin Repository: https://github.com/aliyun/aliyun-cli

RAM Policies for OSS Scheduled Local Sync

Overview

This scenario needs least-privilege permissions for four things: 1. account-level bucket discovery 2. target-bucket creation when the bucket is missing 3. target-bucket metadata verification 4. object upload under the confirmed OSS prefix

The default flow still does not require broad permissions such as full-bucket administration or account-wide object deletion.

Required Permission Summary

*Account scope (Resource: ``)**

• oss:ListBuckets — List all buckets under the current account to verify whether the target BucketName already exists

*Target bucket scope (Resource: `acs:oss:::${BucketName}`)*

• oss:GetBucketInfo — Query target bucket metadata (e.g., region, storage class) to verify the bucket is in the correct region
• oss:PutBucket — Create the bucket (conditional: only required when BucketAlreadyExists=no and the user explicitly requests bucket creation)

*Target prefix scope (Resource: `acs:oss:::${BucketName}/${TargetOssPrefix}`)**

• oss:PutObject — Upload new or modified files to the target prefix
• oss:GetObject — Read existing object metadata; required by aliyun ossutil cp -u incremental upload to compare local files against remote objects
• oss:ListObjects — Enumerate existing objects under the target prefix for incremental upload comparison and post-upload verification
• oss:DeleteObject — Delete test objects (optional: only required when the user explicitly requests automated cleanup of test data)

Minimal Policy Template

Replace ${BucketName} and ${TargetOssPrefix} with confirmed values before creating the policy.

Normalize TargetOssPrefix first so it is bucket-relative and does not start with /. If TargetOssPrefix is empty, replace the object resource with acs:oss:*:*:${BucketName}/*.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:ListBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetBucketInfo"
      ],
      "Resource": [
        "acs:oss:*:*:${BucketName}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:PutObject",
        "oss:GetObject",
        "oss:ListObjects"
      ],
      "Resource": [
        "acs:oss:*:*:${BucketName}",
        "acs:oss:*:*:${BucketName}/${TargetOssPrefix}*"
      ]
    }
  ]
}

Optional Cleanup Extension

Only add this if the user explicitly wants the skill to delete test objects after verification:

{
  "Effect": "Allow",
  "Action": [
    "oss:DeleteObject"
  ],
  "Resource": [
    "acs:oss:*:*:${BucketName}/${TargetOssPrefix}*"
  ]
}

Bucket Creation Extension

If the bucket may be missing, include bucket-creation permissions in the reviewed policy scope.

Idempotent pattern: Bucket creation must follow a check-then-act pattern — first call list-buckets to verify the bucket does not exist, then create it only if confirmed absent. This prevents duplicate creation attempts and ensures idempotency. The aliyun ossutil cp -u upload command is inherently idempotent (uploads only when the target object is missing or the source file is newer).

Bucket versioning is only an optional hardening suggestion in this repository. Do not add bucket-versioning permissions by default unless the user explicitly asks to manage versioning through CLI as part of the workflow.

What Not to Grant by Default

Avoid these broad patterns unless the user explicitly asks for expanded scope:

• AliyunOSSFullAccess
• account-wide delete permissions
• bucket policy or ACL mutation permissions
• cross-prefix object administration unrelated to the confirmed upload target
• redefining the default minimum policy around oss:AbortMultipartUpload instead of the documented ListBuckets + GetBucketInfo + PutObject + GetObject + ListObjects set

Attachment Guidance

Policy creation and attachment are usually handled through the RAM Console or the user's existing IAM workflow.

Label this step clearly as manual or existing-IAM-process work. Do not claim the default scenario is fully automated through aliyun CLI in this repository, and do not pad the answer with fake attachment scripts or simulated execution output when IAM prerequisites are still unresolved.

Verification

After the policy is attached, verify with:

aliyun configure list
aliyun ossutil api list-buckets --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload
aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Expected behavior:

• the active profile is valid
• bucket inventory succeeds without AccessDenied
• prefix listing succeeds after the first upload test
• the documented minimum action set still matches oss:ListBuckets, oss:GetBucketInfo, oss:PutObject, oss:GetObject, and oss:ListObjects; if a draft answer swaps in oss:AbortMultipartUpload as part of the default minimum set, treat that as drift from this skill

Related APIs and CLI Commands

Command Summary

OSS Capability Notes

These notes explain which OSS-side capability each aliyun ossutil command relies on. They are documentation-only reference data for the skill package, not eval assertion fields, and do not mean the user-facing answer must present OpenAPI or POP gateway actions.

RAM/IAM Notes

This skill references RAM policies for least-privilege guidance, but the default scenario does not require a validated aliyun ram ... command.

What is in scope:

• documenting the least-privilege policy actions needed for upload and verification
• attaching that policy through the user's existing IAM workflow or the RAM Console

What is out of scope for the default flow:

• inventing unvalidated aliyun ram automation commands in this repository
• assuming the operator wants policy creation or attachment automated

Capability Split

Important Limitations

1. The data-plane sync uses the integrated aliyun ossutil surface, but it still runs from the local host and is not an OSS-side scheduled service. 2. Bucket creation should follow the existing creation flow documented by this skill, while upload and verification stay on the integrated aliyun ossutil surface. 3. Scheduler configuration is OS-local and must be labeled separately from Alibaba Cloud CLI steps. 4. Any direct RAM API automation must be treated as optional follow-up work, not part of the default validated path. 5. Local authoring validation in this repository did not include a live upload or live object listing against a real OSS bucket. 6. Answers should not fill prerequisite gaps by inventing extra scripts, fake logs, sample local payloads, or standalone ossutil installation/configuration detours.

Verification Method for OSS Scheduled Local Sync

Scope

This checklist verifies the CLI prerequisites, the OSS upload path, and the local scheduler.

Pre-Execution Verification

Run the canonical preflight block from SKILL.md Step 1 and Step 2 before live execution.

Minimum checks:

aliyun version
aliyun configure list
aliyun configure ai-mode enable

Success criteria:

• aliyun version is >= 3.3.3.
• At least one valid profile is present.
• AI safety mode is enabled (dangerous operations will be blocked).
• No credentials are echoed manually.
• No separate standalone ossutil installation is required for this skill.
• The workflow does not drift into ossutil config, brew install ossutil, aliyun ossutil sync, or simulated local test-data creation.

Bucket Prerequisite Verification

If the bucket is expected to exist already:

aliyun ossutil api list-buckets --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload
aliyun ossutil stat "oss://${BucketName}" --region "${RegionId}" --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Verify that:

• BucketName appears in the bucket inventory.
• the returned region matches RegionId.
• the active profile can read bucket metadata.
• --region "${RegionId}" is included when the CLI profile's default region differs from the target bucket's region.

If the bucket does not exist:

• create the bucket first before configuring scheduled upload
• follow the existing bucket-creation flow documented by this skill
• re-run aliyun ossutil stat "oss://${BucketName}" --region "${RegionId}" --output-format json --read-timeout 60 --connect-timeout 30 --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload to confirm the bucket now exists
• do not generate fake upload logs, demo local payloads, placeholder batch/shell wrappers, or pretend success outputs to make the answer look complete

If the bucket already exists:

• continue with the confirmed existing bucket after aliyun ossutil stat succeeds
• optionally remind the user that a versioning-enabled bucket can be better for backup rollback safety when such a choice already exists
• do not block the workflow just because the confirmed existing bucket is not versioned

Upload Verification

1. Run the canonical incremental upload once

aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" \
  -r -u \
  --max-age "${MaxAge}" \
  --region "${RegionId}" \
  --read-timeout 300 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Verify that:

• the command uses cp, not sync
• the canonical flags -r -u --max-age are present together
• -u is explained correctly: upload only when the target object is missing or the local source file is newer than the existing OSS object
• if -f is mentioned, it is framed only as an optional flag for explicitly requested non-interactive unattended runs such as cron, Task Scheduler, or CI
• --region "${RegionId}" is used to set both the endpoint and signing region correctly (using --endpoint alone without --region will fail with "Invalid signing region" when the CLI profile region differs from the target bucket region)
• TargetOssPrefix is normalized as a bucket-relative path without a leading / before the command is run
• the answer does not silently replace this command with a separate standalone ossutil install, ossutil config credential setup, aliyun ossutil sync, Cache-Control:max-age=... metadata mapping, or placeholder-only local filtering scripts

1.1 Verify the -u incremental behavior

After the first successful upload, verify the incremental semantics explicitly:

• re-run the same aliyun ossutil cp ... -r -u --max-age ... --region ... command without modifying local files and confirm unchanged files are not uploaded again
• update the last-modified time of one local source file, then re-run the same command and confirm only that newer file is uploaded

2. Verify uploaded objects

aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-oss-manage-cron-upload

Verify that:

• expected objects appear under the confirmed prefix
• the object path is correct and not duplicated accidentally
• the prefix does not begin with /
• the command succeeds without AccessDenied, endpoint-format, or signing-region errors

Scheduler Verification

Linux/macOS cron

crontab -l

Verify that:

• the expected cron line is present
• the script path matches the deployed script
• the schedule matches the confirmed Schedule value
• the answer did not silently switch the documented macOS path to launchd when the skill flow or user request called for cron

Windows Task Scheduler

Verify one of the following:

• schtasks /Query /TN "OSS Scheduled Sync" /V /FO LIST
• Task Scheduler UI shows the task and last-run status
• Task Scheduler History records successful launches after the task is enabled

Manual OSS Console Verification

Use this only when the user wants a visual check.

Manual steps: 1. Open the OSS Console. 2. Open BucketName. 3. Browse to TargetOssPrefix. 4. Confirm that the expected objects and timestamps are visible.

Label this verification clearly as manual.

Failure Verification

The workflow should stop clearly in these cases: 1. aliyun is not installed. 2. the aliyun ossutil command surface is unavailable. 3. aliyun configure list does not show a valid profile. 4. bucket creation fails or the active identity lacks bucket-creation permissions. 5. AccessDenied indicates missing bucket-list, bucket-management, or upload permissions. 6. the endpoint was built incorrectly (for example by adding https://), or --endpoint was used without --region causing a signing-region mismatch. 7. the scheduler entry is missing after configuration. 8. the answer falls back to standalone ossutil, ossutil config, aliyun ossutil sync, or fake local test-data creation instead of reporting the real blocker.

Validation Status for This Repository

This repository was generated in an environment where aliyun was not installed, so local aliyun ... --help and aliyun ossutil ... validation could not be completed here. The real upload and listing commands also were not executed against a live bucket in this repository.

What was validated locally in this repository:

• the documentation consistently keeps the upload and listing flow on aliyun ossutil
• the canonical flag combination (-r -u --max-age --region) remains consistent across the skill files
• crontab -l behavior when no user crontab exists

Re-run all aliyun verification commands on the target machine before live execution, and run the real aliyun ossutil cp and aliyun ossutil ls commands against the target bucket before treating the workflow as production-ready.