Always through python3 -B <skill目录>/scripts/sms_cli.py execute business, do not bypass script invocation to write
Action. By default the customer will not use the terminal: the Agent is responsible for installation, login, commands, and cleanup, and the customer only operates the browser
and confirms business writes. Unless the customer asks, do not display commands, JSON, CLI, Profile, HOME, AK/SK, or sandbox.
Entry process
- On first call or authentication failure read auth-setup.md, execute
auth-doctorand strictly follow the uniqueerror.remediation;auth_readythen resume the original task. - On the first business call execute the read-only
list-message-groups. OnlyRE:0001reads service-onboarding.md; an empty list and missing resources do not mean the service is not activated. - Read the minimal reference set below according to the task, then execute the CLI.
Read according to the task
- All tasks first read the common Action configuration and error rules:actions.md。
- For qualification, signature, and template applications read application-contracts.md。
- For qualification materials and local forms also read
qualification-materials.md; the display method is determined by the
qualification-display.mdlinked therein. - For single send, bulk send, receipts, and analysis read delivery-contracts.md。
- When the complete orchestration order is needed read workflows.md。
- For write operation authorization, desensitization, retries, and reconciliation uniformly read rules.md。
CLI workflow
- Query:
list-message-groups、message-group-detail、list-qualifications、list-signatures、list-templates。 - Qualification: first try the MCP App right panel; call
open_qualification_applicationthen immediately callensure_qualification_application_visible. When the panel is not visible, per qualification-display.md switch to the host built-in browser, and only when the host does not support it use the system browser. - Apply:
*-preview→ customer confirmation →*-submit。 - Single send:
match-template→send-preview→ customer authorization →send-submit→send-status。 - Bulk send:
batch-template-demo/batch-precheck→batch-create→batch-launch-preview→ specified task authorization →batch-launch-submit; for management usebatch-detail、batch-list、batch-cancel。 - Analysis:
analytics; only when message-level evidence is needed add--include-logs。
Immutable boundaries
- Authentication only executes remediation; one login session at a time. For other login methods do not request a login entry link, and AK/SK
only prompts one set of
VOLCENGINE_*variables when the customer actively chooses. - Qualification sensitive materials are only filled in the local wizard. The Agent reads the masked
QUALIFICATION_EXCHANGEandQUALIFICATION_FAILUREfor troubleshooting, and does not ask the customer to copy fields or upload them to the conversation. - Applications, sending, and task startup are all based on the current preview authorization; re-preview after fields change.
- Do not retry or switch invocation paths for write requests that may already have been sent; return
outcome_unknownand reconcile according to the contract. - Creating or starting a bulk send does not mean delivery; only the public sending log is message-level evidence.
- The final output does not contain complete personal information, images, file addresses, credentials, tickets, Authorization, or signature URL query parameters; retain the public Request ID and error code, and do not infer internal reasons.