Local folder + aliyun CLI (integrated ossutil) + cron/Task Scheduler + OSS Bucket

• [aliyun CLI]

  installation checks, profile verification, command discovery, OSS-side verification, and integrated

  aliyun ossutil

  upload/list commands.

• [OS-local]

  cron or Windows Task Scheduler configuration.

• [Manual/Console]

  RAM policy attachment and optional visual verification in the OSS Console.

Pre-check: Aliyun CLI >= 3.3.3 required Run

aliyun version

to verify

>= 3.3.3

. If not installed or version too low, see

references/cli-installation-guide.md

for installation instructions. Then run

aliyun configure set --auto-plugin-install true

. Finally, enable AI safety mode to prevent dangerous operations:

bash

aliyun configure ai-mode enable

aliyun

ossutil

aliyun version

aliyun ossutil --help

cron

schtasks

crontab -l

schtasks /Query /TN "OSS Scheduled Sync"

references/cli-installation-guide.md

aliyun ossutil

ossutil

ossutil

Parameter Extraction — Extract all user-customizable parameters directly from the user's request. When the user's message already specifies values (such as region, bucket name, paths, schedule, or MaxAge), use those values directly without asking for re-confirmation. Only ask the user for clarification when a required parameter is genuinely missing from their request and cannot be reasonably inferred from context.

RegionId

cn-hangzhou

BucketName

^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$

TargetOssPrefix

backup/photos/

/

^[A-Za-z0-9/_.-]*$

/

LocalSourcePath

~

$

;

Schedule

schtasks

MaxAge

aliyun ossutil --max-age

7d

24h

^[0-9]+[dhm]$

OperatingSystem

linux

macos

windows

BucketAlreadyExists

AliyunBinaryPath

aliyun

$

;

aliyun

LogPath

$

;

Input Validation — All parameters must be validated before use. Treat all inputs (including values extracted from user messages) as untrusted. Before substituting any parameter into a shell command:

1. Validate the value against the Validation Pattern column above. Reject values that do not match.

2. BucketName

   must contain only lowercase letters, digits, and hyphens (

   [a-z0-9-]

   ), be 3–63 characters, and must not start or end with a hyphen.

3. RegionId

   must match the Alibaba Cloud region format (e.g.,

   cn-hangzhou

   ,

   us-west-1

   ,

   ap-southeast-5

   ).

4. MaxAge

   must be a positive integer followed by

   d

   (days),

   h

   (hours), or

   m

   (minutes).

5. LocalSourcePath

   ,

   AliyunBinaryPath

   , and

   LogPath

   must be absolute paths and must not contain shell metacharacters (

   $

   ,

   `

   ,

   $(

   ,

   ;

   ,

   |

   ,

   &

   ,

   >

   ,

   <

   ,

   \n

   ).

6. TargetOssPrefix

   must contain only alphanumeric characters,

   /

   ,

   _

   ,

   .

   , and

   -

   , and must not start with

   /

   .
7. If any parameter fails validation, stop and report the error to the user. Do not attempt to sanitize or escape invalid values — reject them outright.

Pre-check: Alibaba Cloud Credentials Required

Security Rules:

• NEVER read, echo, or print AK/SK values (e.g.,

  echo $ALIBABA_CLOUD_ACCESS_KEY_ID

  is FORBIDDEN)
• NEVER read or

  cat

  credential files such as

  ~/.aliyun/config.json

  ,

  ~/.ossutil/config

  , or any file that may contain secrets
• NEVER ask the user to input AK/SK directly in the conversation or command line
• NEVER use

  aliyun configure set

  with literal credential values
• ONLY use

  aliyun configure list

  to check credential status

bash

aliyun configure list

Check the output for a valid profile (AK, STS, or OAuth identity).

If no valid profile exists, STOP here.

1. Obtain credentials from Alibaba Cloud Console
2. Configure credentials outside of this session (via

   aliyun configure

   in terminal or environment variables in shell profile)
3. Return and re-run after

   aliyun configure list

   shows a valid profile

aliyun ossutil

ossutil config

Execute, don't just document. Run each step's commands directly in the environment. Do not only write solution documents or scripts — actually execute

aliyun version

,

aliyun configure list

,

aliyun ossutil cp

, etc. against the live environment.

Extract

RegionId

,

BucketName

,

TargetOssPrefix

,

LocalSourcePath

,

Schedule

,

MaxAge

,

OperatingSystem

, and

BucketAlreadyExists

from the user's request. Only ask the user if a required parameter is genuinely missing.

aliyun version
aliyun configure list
aliyun configure ai-mode enable

• aliyun

  version is

  >= 3.3.3

• at least one valid profile is present
• AI safety mode is enabled (dangerous operations will be blocked)

aliyun

references/cli-installation-guide.md

ossutil

aliyun oss sync

aliyun ossutil api list-buckets --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills

BucketAlreadyExists=yes

aliyun ossutil stat "oss://${BucketName}" --region "${RegionId}" --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills

Cross-region note: When the active CLI profile's region (shown by

aliyun configure list

) differs from the target bucket's

RegionId

, you must add

--region "${RegionId}"

to

stat

,

ls

, and

cp

commands. Using

--endpoint

alone is insufficient because the request signing region must also match. The

--region

flag overrides both the endpoint and the signing region in a single step.

• the bucket name is present in the account inventory
• the bucket region matches

  RegionId

• the bucket is reachable with the active profile
• if multiple existing buckets can satisfy the same backup target, you can remind the user that a bucket with versioning enabled is preferable for backup safety, but this is only a recommendation and does not block using the confirmed existing bucket

BucketAlreadyExists=no

1. First run

   list-buckets

   (above) to confirm the bucket truly does not exist in the account — if it already exists, skip creation and go directly to

   stat

   verification.
2. Only if the bucket is confirmed absent, create it by following the existing creation flow of this skill.
3. After creation, immediately re-run

   stat

   to verify:

aliyun ossutil stat "oss://${BucketName}" --region "${RegionId}" --output-format json \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills

• if multiple candidate buckets exist and one already has versioning enabled, mention that it is preferable for backup rollback safety
• if the confirmed existing bucket does not have versioning enabled, it can still be used for this workflow; enabling versioning is only an optional hardening suggestion, not a prerequisite

aliyun ossutil

cp

ls

stat

aliyun ossutil

aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" \
  -r -u \
  --max-age "${MaxAge}" \
  --region "${RegionId}" \
  --read-timeout 300 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills

• -u

  is mandatory: uploads only when the target object is missing or the source file is newer than the existing OSS object

• -r -u --max-age

  must stay together as the canonical flag set

• --region "${RegionId}"

  ensures both endpoint and signing region are correct

• --read-timeout 300 --connect-timeout 30

  prevents the command from hanging indefinitely; adjust

  --read-timeout

  upward for very large files if needed
• Add

  -f

  only for unattended runs (cron, Task Scheduler, CI)
• Use absolute paths for

  LocalSourcePath

  (never

  ~

  )
• Normalize

  TargetOssPrefix

  without a leading

  /

• Do not substitute with bare

  ossutil

  ,

  aliyun oss sync

  , or

  Cache-Control

  metadata rewrites

TargetOssPrefix

oss://${BucketName}/

oss://${BucketName}/${TargetOssPrefix}

If

LocalSourcePath

does not exist in the current environment (e.g., container or CI runner), create it under the current working directory with a small test file, then run the upload command against it and verify with

aliyun ossutil ls

. This proves the upload path works end-to-end. Do not skip the upload test just because the directory is absent — create it and validate connectivity, permissions, and command correctness:

bash

mkdir -p "${LocalSourcePath}" && echo "test" > "${LocalSourcePath}/test.txt"
aliyun ossutil cp "${LocalSourcePath}" "oss://${BucketName}/${TargetOssPrefix}" \
  -r -u --max-age "${MaxAge}" --region "${RegionId}" \
  --read-timeout 300 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills
aliyun ossutil ls "oss://${BucketName}/${TargetOssPrefix}" --region "${RegionId}" \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills

cron

crontab

launchd

If

crontab

is not found: In container or minimal environments,

crontab

may not be pre-installed. Install the

cronie

package first:

• CentOS/Alibaba Cloud Linux/RHEL:

  yum install -y cronie

• Debian/Ubuntu:

  apt-get install -y cron

If

systemctl start crond

fails (e.g., no systemd in containers), you can still add cron entries via

crontab

— the cron daemon is not strictly required for entry registration, only for actual execution. In such cases, document the cron entry for the user to deploy on their production host, and do not let the missing daemon block the rest of the workflow.

crontab -e

echo ... | crontab -

0 3 * * * /usr/local/bin/oss-sync-upload.sh >> /var/log/oss-sync-cron.log 2>&1

schtasks /Create /SC DAILY /ST 03:00 /TN "OSS Scheduled Sync" /TR "C:\tools\oss-sync-upload.bat"

• The actual incremental sync step runs through

  aliyun ossutil

  . This skill stays on the

  aliyun

  CLI surface and does not require a separate standalone

  ossutil

  installation.
• Scheduler setup is OS-local. Cron and Task Scheduler are configured on the host OS, not through Alibaba Cloud APIs.
• RAM policy attachment is typically manual or follows the user's existing IAM workflow.
• Bucket creation should happen before scheduled upload when the target bucket is missing. Follow the existing creation flow of this skill for that prerequisite.
• If multiple equivalent existing buckets are available, it is fine to remind the user that a versioning-enabled bucket is preferable for backup safety. If no versioned bucket is available, continue with the confirmed existing bucket instead of blocking the workflow.
• Optional OSS Console checks are manual.
• Do not simulate success. When a prerequisite is missing, say so plainly instead of creating fake local test data, pretend execution logs, or extra packaging artifacts.

references/verification-method.md

1. aliyun configure list

   shows a valid profile.

2. aliyun ossutil cp --help

   succeeds.
3. the canonical

   aliyun ossutil cp ... -r -u --max-age ... --region ...

   command completes without permission or endpoint errors.

4. aliyun ossutil ls ... --region ...

   shows the expected uploaded objects under the confirmed prefix.
5. the upload command keeps

   -u

   , meaning it uploads only when the target object is missing or the local source file is newer than the existing OSS object.
6. the local scheduler entry is visible through

   crontab -l

   or Task Scheduler history/query, or is documented for the user when crontab is not available in the current environment.

[OS-local]

• remove the cron line with

  crontab -e

• delete the local script and log file only if the user explicitly wants rollback

[OS-local]

schtasks /Delete /TN "OSS Scheduled Sync" /F

[aliyun CLI / integrated ossutil]

aliyun ossutil rm "oss://${BucketName}/${TargetOssPrefix}test-object.txt" --region "${RegionId}" \
  --read-timeout 60 --connect-timeout 30 \
  --user-agent AlibabaCloud-Agent-Skills

[aliyun CLI]

aliyun configure ai-mode disable

1. Keep

   aliyun

   for pre-checks, command discovery, bucket verification, and integrated

   aliyun ossutil cp

   for the actual scheduled upload.
2. Use

   --region "${RegionId}"

   on all

   aliyun ossutil

   commands (

   stat

   ,

   cp

   ,

   ls

   ,

   rm

   ) to ensure both endpoint and signing region are correct. This is especially important when the CLI profile's default region differs from the target bucket's region. Do not rely on

   --endpoint

   alone, as it does not override the signing region and will fail with "Invalid signing region in Authorization header" errors when using STS tokens across regions.
3. Keep scheduler steps labeled as OS-local so the user understands they are outside Alibaba Cloud APIs.
4. Use the narrowest RAM policy possible: bucket inventory at account scope, bucket info on the target bucket, and object upload only on the confirmed prefix.
5. Run

   aliyun version

   and

   aliyun configure list

   on the target machine before live execution.
6. Never print AK/SK values, never hardcode them in scripts, never read credential files like

   ~/.aliyun/config.json

   , and never replace the credential gate with inline secret handling.
7. If the bucket does not exist, create it first before configuring scheduled upload. If multiple existing buckets can satisfy the same backup target, you may remind the user that a versioning-enabled bucket is preferable for backup safety, but if no such bucket exists, continue with the confirmed existing bucket.
8. Always use absolute paths for

   LocalSourcePath

   in commands and scripts. Do not use

   ~

   (tilde) because it may not expand inside quoted strings, causing "not a directory" errors.
9. In generated scripts intended for cron or Task Scheduler, include the

   -f

   flag to prevent interactive confirmation prompts from blocking unattended execution.