CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cloud-storage-web

Complete guide for CloudBase cloud storage using Web SDK (@cloudbase/js-sdk) - upload, download, temporary URLs, file management, and best practices.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugin/cloudbase/skills/cloud-storage-web/SKILL.md

The canonical home for this skill is cloud-storage-web in TencentCloudBase/CloudBase-AI-Toolkit

SKILL.md
Quality
Evals
Security

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable, with executable code for both storage modes and unusually strong validation/feedback loops in its workflows. Its weaknesses are token efficiency — the bucket prerequisite and security-domain guidance are repeated across many sections — and the absence of any reference files, leaving PG-mode deep-dive material inlined in the overview.

Suggestions

Consolidate the bucket-existence prerequisite, currently stated in ~5 places (common mistakes, minimal checklist, the dedicated section, the PG-mode warning, and upload rules), into one canonical section referenced from the others.

Move the PG/pgstore deep-dive (return-shape tables, RLS SQL templates, URL resolution strategies, Supabase parity table) into a references/ file and link to it from SKILL.md.

Trim generic best practices Claude already knows (validate file size/type before upload, use clear folder structure, clean up obsolete files) to reduce token load.

DimensionReasoningScore

Conciseness

The core API sections (Upload, Temporary URLs, Delete, Download, init) are efficient, but the bucket-existence prerequisite is repeated across roughly five sections (common mistakes, minimal checklist, the dedicated prerequisite section, the PG-mode warning, and upload rules), and the local-dev recipe overlaps the security-domain reminder — matching anchor 3's 'mostly efficient but could be tightened'. It avoids a 2 because the repeated material is non-obvious gotcha content rather than explanations of concepts Claude already knows.

3 / 5

Actionability

Fully executable, copy-paste-ready code for every operation in both legacy and PG modes ('app.uploadFile({...})', 'app.storage.from(\'covers\').upload(...)'), executable RLS SQL, concrete MCP tool invocations ('queryEnv', 'action="domains"'), and specific DevTools debugging steps (inspect the 'POST .../v1/storages/get-objects-upload-info' response 'code' field). Common cases for both environment modes are covered, matching anchor 5.

5 / 5

Workflow Clarity

The local dev recipe is a numbered 6-step sequence with explicit validation (poll 'queryEnv(action="domains")' rather than blind-sleeping, re-check the exact host:port), and the pre-upload steps include error-code-driven recovery loops ('If app.uploadFile() returns STORAGE_NOT_EXIST, stop editing frontend code and fix the environment-side storage resource first'). Destructive delete operations include validation ('Always inspect per-file results before assuming deletion succeeded'), matching anchor 5's explicit checkpoints and feedback loops.

5 / 5

Progressive Disclosure

The body is well-sectioned with clear headers, but at ~320 lines it inlines deep PG/pgstore material (return-shape comparison tables, RLS SQL templates, Supabase parity table, URL resolution strategies) that clearly belongs in separate reference files, and no bundle files exist to offload it — matching anchor 3's 'content that should be separate is inline'. It is not 2 because structure and sibling-skill references are clearly signaled, and not 4 because the majority of the specialized content is inlined rather than appropriately split.

3 / 5

Total

16

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description names a specific domain and SDK with several concrete capabilities, but omits any explicit 'Use when...' trigger clause, capping completeness at 3. Generic filler ('file management, and best practices') dilutes specificity and misses natural trigger terms like 'delete files' or the SDK API names.

Suggestions

Add an explicit trigger clause, e.g. 'Use when a browser or Web app must upload, download, or manage files in CloudBase storage with @cloudbase/js-sdk.'

Replace the generic 'file management, and best practices' with concrete actions such as 'delete files' and 'trigger browser downloads'.

Include natural trigger keywords users would actually say, such as 'uploadFile', 'getTempFileURL', or 'CloudBase storage bucket'.

DimensionReasoningScore

Specificity

Names the domain and SDK ('CloudBase cloud storage using Web SDK (@cloudbase/js-sdk)') plus several concrete actions ('upload, download, temporary URLs'), matching anchor 4. It is not 5 because 'file management' and 'best practices' are generic non-actions, leaving minor gaps in coverage.

4 / 5

Completeness

The 'what' is clear (upload, download, temporary URLs, file management via the Web SDK), but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines. This exactly matches anchor 3: clear 'what' with 'when' missing.

3 / 5

Trigger Term Quality

Good natural keyword coverage — 'cloud storage', 'upload', 'download', 'temporary URLs', plus the package name '@cloudbase/js-sdk' — matching anchor 4. It falls short of 5 because it lacks common variations and synonyms users would say, such as 'delete files', 'file preview', or API names like 'uploadFile'/'getTempFileURL'.

4 / 5

Distinctiveness Conflict Risk

The niche is well pinned by 'CloudBase cloud storage' and 'Web SDK (@cloudbase/js-sdk)', giving mostly distinct triggers with only minor overlap risk against closely related sibling skills (Mini Program storage, backend/MCP storage management, static hosting). It is not 5 because a user asking generically to 'upload a file to CloudBase' could still land on the wrong sibling skill.

4 / 5

Total

15

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

TencentCloudBase/CloudBase-AI-Toolkit

Path

plugin/cloudbase/skills/cloud-storage-web/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.