Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hxy91819/mason-skills --skill tencent-cloud-pitfallsgit clone --depth 1 https://github.com/hxy91819/mason-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hxy91819/mason-skills/tencent-cloud-pitfalls)<a href="https://agentmods.dev/skills/hxy91819/mason-skills/tencent-cloud-pitfalls"><img src="https://agentmods.dev/badge/skills/hxy91819/mason-skills/tencent-cloud-pitfalls/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hxy91819/mason-skills/tencent-cloud-pitfalls"><img src="https://agentmods.dev/badge/skills/hxy91819/mason-skills/tencent-cloud-pitfalls.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.01001 |
| Opus 5.5 | $0.00048 | $0.00400 |
| Sonnet 5.5 | $0.00024 | $0.00200 |
| Haiku 4.5 | $0.00012 | $0.00100 |
Grade A, and why
tencent-cloud-pitfalls scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
腾讯云开通与排障踩坑
这些经验来自一个平台项目：2026-11 在一个全新的生产主账号上开通 TKE、数据库、日志、监控和镜像仓库。
同样的参数在老账号上能成功，在新账号上却被拒，而且报错不提缺什么。花时间最多的几次：
| 问题 | 耗时 |
|---|---|
| VPC-CNI 开启被拒 | 约 23.5 小时、10 个 MR |
| 云监控原生告警不触发 | 约 1.5 天 |
| CLS 采集组件逐个暴露缺权限 | 约 1 天、十余个 MR |
| TCR 首次创建 | 约 20 小时 |
新账号：先对齐账号层，再开通产品
先拿一个跑通过同类产品的老账号做参照，逐项对比下面三类，再开始写产品资源。
- 服务角色。 用
tccli cam DescribeRoleList列出两个账号的角色，按角色名对比。新账号缺的角色，用GetRole和ListAttachedRolePolicies从老账号抄下信任主体和预设策略，再用 IaC 建：只信任官方 service 主体，只挂预设策略。 - 服务开通。 SSM、CFS、Private DNS 这类要单独开通的服务，做成一个一次性的登记入口，不要在产品资源里顺手开通。
- 控制台授权。 有些授权只能由账号负责人在控制台同意，例如 TCR 首次创建。开工前把这类授权列出来交给负责人。
完成判据： 计划用到的每个产品都标了三种结论之一：角色已建、服务已开通、确认不需要。
一个新账号实际缺过的，可作对照起点（不是全集）：
_QCSRole结尾的服务角色：CloudAudit、TKE、AS、TCR、IPAMDofTKE；- 两个
CM_QCSLinkedRole*：InQueryInstance、InCloudResources； - 三项服务开通：SSM、CFS、Private DNS。
API 拒绝又不说明原因时
- 先查账号级前提：角色、服务开通、白名单、配额。资源属性逐项对比都一致时，差异多半在账号层，地域和参数可以放到后面查。
- 每次只改一个变量：用 0 节点的临时集群，一次只改一个字段，同时保留一个对照（换个地域，或换个账号）。最后在同一个对象上只补上候选的前提，看结果是否翻转；翻转了才算确认根因。
- 工单只问一件事：请厂商诊断一个具体的 RequestId，并写明不需要代为操作。
- 结果不明的写请求不重发，尤其是采购类。先回读订单或资源，确认没成功再发。
- CAM 改动有传播延迟，刚补完授权立刻失败的，隔一会儿再试一次。
按产品查
开通或修改某个产品之前，先读 references/product-pitfalls.md 里对应的一节。涵盖：
- TKE 网络与 DNS
- CLS 采集
- 云监控
- COS
- TAT
- 自定义镜像
- CLB
- TCR
- DNSPod
- 删除顺序
- 单账号多业务时的 CAM
- 配额与账单
- 零散的参数问题
用临时管理员密钥操作生产账号，或在多人共用的账号里操作时，先读 references/production-operations.md。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 62 lines · 120 tokens per session scan A 2f64d1e1db74
tencent-cloud-pitfalls is a skill published in the GitHub repository hxy91819/mason-skills (3 stars, last pushed today), licensed MIT. It adds 120 tokens to every session and 1,001 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-08.
tencent-cloud-pitfalls compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| tencent-cloud-pitfallshxy91819/mason-skills | Skill | 3 | today | MIT | A | 120 | Codex |
| mem0-oss-to-platformmem0ai/mem0 | Skill | 69k | yesterday | Apache-2.0 | A | 217 | Claude Code, Codex |
| azure-mgmt-botservice-dotnetmicrosoft/skills | Skill | 3.2k | yesterday | MIT | A | 78 | Claude Code |
| fastapi-router-pymicrosoft/skills | Skill | 3.2k | yesterday | MIT | A | 46 | Claude Code |
| dev-runtimelangwatch/langwatch | Skill | 5.0k | today | Apache-2.0 | A | 172 | Claude Code |
| api-designericrisco/rsc-harness | Skill | 529 | 4d ago | MIT | A | 105 | Claude Code, Codex |
| migrate-segw-to-raparc-mcp/arc-1 | Skill | 253 | yesterday | MIT | A | 106 | Claude Code |