Skill: lhanyun/tencentcloud-lighthouse-skill (version 1.0.2)

--- name: tencentcloud-lighthouse-skill description: 'Load when: user mentions Lighthouse, 轻量应用服务器, 轻量服务器, or asks to check/create/manage/deploy Lighthouse instances, deploy applications to Lighthouse, manage Lighthouse firewall rules, reset Lighthouse password, view Lighthouse snapshots/images/traffic, monitor Lighthouse metrics, run commands on Lighthouse via TAT, or asks to get/identify the current instance ID. Trigger phrases: "查看轻量服务器", "Lighthouse实例", "轻量应用服务器", "部署应用", "部署程序", "部署到Lighthouse", "管理防火墙规则", "重置密码", "查看快照", "查看流量包", "获取实例ID", "查看实例ID", "当前实例", "实例IP", "check Lighthouse", "create Lighthouse", "deploy app", "deploy application", "Lighthouse firewall", "Lighthouse snapshot", "instance ID", "whoami". NOT for CVM, CBS, VPC, or other non-Lighthouse products.' metadata: { "openclaw": { "emoji": "☁️", "requires": {}, "install": [ { "id": "pip", "kind": "pip", "package": "tccli", "bins": ["tccli"], "label": "Install TCCLI", }, ], "references": [ "instance-management", "application-deployment", "monitoring-alerting", "firewall-management", "remote-command-tat", "snapshot-blueprint", "traffic-package", ], }, } --- # Lighthouse Cloud Server Operations Manage Tencent Cloud Lighthouse instances via tccli CLI. Your knowledge of tccli parameters and API limits may be outdated. **Always use `tccli <service> <action> --help` to verify parameters before execution.** ## Prerequisites ```bash tccli --version ``` If not installed: `pip install tccli` ## Credential Setup | Method | Security | Expiry | Recommendation | |--------|----------|--------|----------------| | OAuth browser login | High | Temporary, expires in 2 hours | Recommended | | AK/SK key pair | Low | Permanent unless revoked | Special cases only | When the user has not chosen a method, default to OAuth. ### OAuth Login (Recommended) Use `script/tccli-oauth-helper.sh` for non-interactive OAuth login: ```bash # Step 1: Check credential status bash script/tccli-oauth-helper.sh --status # Step 2: Generate authorization URL (if credentials are missing or expired) bash script/tccli-oauth-helper.sh --get-url # Step 3: User opens the URL in browser, completes login, and gets a base64 code # Step 4: Complete login with the code bash script/tccli-oauth-helper.sh --code "base64_code_from_browser" # Step 5: Verify tccli lighthouse DescribeRegions ``` **Workflow:** 1. Run `--status` to check existing credentials 2. If expired/missing, run `--get-url` — show the URL to user 3. User opens URL → logs in → copies the base64 code from browser 4. Run `--code` with the base64 code to complete login 5. Verify with `tccli lighthouse DescribeRegions` **Notes:** - Credentials are temporary (expires in ~2 hours) - State is valid for 10 minutes after `--get-url` - Do NOT use `tccli sts GetCallerIdentity` to verify — it does not support OAuth credentials ### AK/SK Setup Only if the user explicitly provides SecretId and SecretKey: ```bash tccli configure set secretId <SecretId> tccli configure set secretKey <SecretKey> tccli configure set region ap-guangzhou ``` ### Logout ```bash tccli auth logout ``` ## Quick Reference | Task | Command | |------|---------| | List instances | `tccli lighthouse DescribeInstances --region <region>` | | Instance details | `tccli lighthouse DescribeInstances --region <region> --InstanceIds '["lhins-xxx"]'` | | Firewall rules | `tccli lighthouse DescribeFirewallRules --region <region> --InstanceId lhins-xxx` | | Monitoring data | `tccli monitor GetMonitorData --Namespace QCE/LIGHT_HOUSE ...` | | Run remote command | `tccli tat RunCommand --region <region> --InstanceIds '["lhins-xxx"]' --Content "..."` | | Snapshots | `tccli lighthouse DescribeSnapshots --region <region>` | | Traffic packages | `tccli lighthouse DescribeInstancesTrafficPackages --region <region> --InstanceIds '["lhins-xxx"]'` | | Available regions | `tccli lighthouse DescribeRegions` | | Help for any action | `tccli lighthouse <Action> --help` | | Get current instance ID | `bash script/whoami.sh` or `bash script/whoami.sh --id` | ## Scenario Routing Read the corresponding reference file before executing: ``` User wants to... ├─ Query / start / stop / reboot instances -> references/instance-management.md ├─ Reset password / view blueprints -> references/instance-management.md ├─ Deploy applications / verify deployment -> references/application-deployment.md ├─ View CPU / memory / bandwidth metrics -> references/monitoring-alerting.md ├─ Set up alarm policies -> references/monitoring-alerting.md ├─ Manage firewall rules -> references/firewall-management.md ├─ Execute commands on instance -> references/remote-command-tat.md ├─ Create / restore snapshots -> references/snapshot-blueprint.md ├─ Create custom images -> references/snapshot-blueprint.md ├─ Check traffic usage -> references/traffic-package.md ├─ Identify current instance (ID / IP) -> bash script/whoami.sh [--id | --ip] └─ Other operations -> tccli lighthouse --help ``` ## Operation Safety | Risk | Operations | Confirmation | |------|-----------|--------------| | High | Delete instance, apply snapshot, delete snapshot/blueprint | Double confirm, state irreversibility | | Medium | Stop/reboot instance, modify firewall, run commands | Single confirm | | Low | Query, list, describe, help | Execute directly | Rules: 1. **Region is required** for all operations except `DescribeRegions` 2. **Query before modify** — always `Describe` first, never blind `Create` / `Delete` 3. **Use real IDs** — get InstanceId from `DescribeInstances`, never use placeholders 4. **Verify parameters** — run `--help` when unsure about parameter names or formats 5. Lighthouse and CVM are separate products — do NOT mix their APIs 6. **Create means new** — when user asks to "create" / "deploy" / "set up" something (e.g., "create a server", "deploy an app"), create a NEW instance by default. Do NOT use existing instances unless the user explicitly specifies an existing instance ID. ## Common Regions | Code | Location | |------|----------| | ap-beijing | Beijing | | ap-shanghai | Shanghai | | ap-guangzhou | Guangzhou | | ap-chengdu | Chengdu | | ap-chongqing | Chongqing | | ap-nanjing | Nanjing | | ap-hongkong | Hong Kong | Run `tccli lighthouse DescribeRegions` for the full list. ## Channel Output Compatibility Many messaging channels (WeChat, 企业微信, Slack, Teams, Telegram, etc.) apply Markdown rendering or Markdown-to-plain-text conversion before displaying messages. Common transformations that **silently corrupt output**: - **Paired underscores** stripped: `_xxx_` → `xxx` (italic markers) - **Paired asterisks** stripped: `*xxx*` → `xxx` (bold/italic markers) - **Backslash escapes** consumed or displayed literally - **URLs** with special characters mangled or truncated This corrupts: - **URLs** containing underscores (e.g., `redirect_url`, `app_id` in OAuth links) - **CLI output** with underscored identifiers (e.g., `instance_name`, `secret_id`) - **Script output** containing underscored fields or special characters **Rules for all channel output:** 1. **URLs**: Replace `_` (underscore) with `%5F` in any URL shown to the user. For example, the OAuth authorization URL parameters like `redirect_url`, `app_id` must use `%5F` instead of `_`. 2. **CLI / script output**: Always wrap output in code blocks (triple backticks) to prevent Markdown interpretation. Prefer code blocks for any multi-line output containing underscores, asterisks, or other Markdown-sensitive characters. 3. **General text**: Avoid bare underscores and asterisks in plain text. Use backtick-wrapped inline code for any identifier containing these characters (e.g., `instance_name`, `secret_id`). 4. **Links**: When providing clickable links, ensure the full URL is inside a code block or use URL-encoding for special characters. Do not rely on Markdown link syntax `[text](url)` — the URL may be altered by the channel. ## Error Handling 1. Check credentials: `tccli lighthouse DescribeRegions` 2. Verify the region parameter 3. Run `tccli lighthouse <Action> --help` to confirm parameter format 4. Check instance status: `tccli lighthouse DescribeInstances --region <region>`


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)