Alicloud Compute Fc Serverless Devs

Alibaba Cloud Function Compute (FC 3.0) skill for installing and using Serverless Devs to create, deploy, invoke, and remove a Python function. Use when user...

Security Scan

The skill is a plausible instruction-only guide for Alibaba Cloud Serverless Devs, but it omits declaring required credentials in its metadata and contains small inconsistencies (env-var names, sudo usage) that reduce confidence and warrant caution.

Purpose & Capability

The name/description match the instructions: the SKILL.md walks through installing Serverless Devs, configuring Alibaba Cloud credentials, initializing, deploying, invoking, and removing FC (Function Compute) functions. Asking for Node/npm and cloud AccessKeyID/AccessKeySecret is appropriate for this purpose.

Instruction Scope

Instructions only reference expected CLI operations and local paths (creating s.yaml, code/, and an output/ evidence directory). They instruct the user to configure credentials and to save evidence under output/. There are no unexpected external endpoints or instructions to read unrelated system files. However, the doc recommends using sudo for installing and running some commands (which can cause credential/config writes as root) and suggests environment-variable patterns for secrets — both are sensitive actions that should be handled carefully.

Install Mechanism

This is an instruction-only skill with no install spec or bundled code. The instructions recommend installing Serverless Devs via npm (or running via npx). No remote arbitrary archive downloads or opaque installers are embedded in the skill itself.

Credentials

The SKILL.md clearly requires Alibaba Cloud credentials (AccountID, AccessKeyID, AccessKeySecret) and suggests environment-variable usage, but the skill metadata declares no required environment variables or primary credential. The documentation also uses inconsistent env-var names in places (examples include ALIBABA_CLOUD_ACCESS_KEY_ID, ALIBABA_CLOUD_ACCESS_KEY_SECRET and later ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET), which is a coherence issue and increases the chance of user error or accidental credential exposure.

Persistence & Privilege

The skill is not always-on, is user-invocable, and does not request system-wide config paths in its metadata. It does instruct the user to run the Serverless Devs CLI which will store credentials/config locally (expected behavior), but the skill itself does not request permanent elevated privileges.

What to consider before installing

This skill appears to be a legitimate how-to for using Serverless Devs with Alibaba Cloud, but take these precautions before installing/running anything: - Expect to provide Alibaba Cloud AccessKeyID/AccessKeySecret (AK/SK) and AccountID for deploy operations; the registry metadata does not list them explicitly — that omission is likely an authoring error. - Do not paste secrets into chat. Use temporary or least-privilege credentials for testing, and rotate them after use. - Prefer npx (non-global install) or a local install over running the CLI as root (avoid sudo when possible), since running with sudo may store credentials/config under root and increase risk. - Be aware of the inconsistent env-var names in the docs (ALIBABA_CLOUD_* vs ALICLOUD_*). Confirm the exact variable names the CLI expects before exporting secrets. - Run the suggested minimal read-only connectivity test first (as the SKILL.md recommends) to confirm permissions and region, and verify where the CLI stores its credential files on disk. - If you need stronger assurance, request the author to update the skill metadata to declare required environment variables and to remove the sudo recommendations or explain why sudo is necessary.

Category: tool

Function Compute (FC 3.0) Serverless Devs

Goals

• Install and validate Serverless Devs.
• Configure credentials, initialize example project, deploy, invoke, and remove.
• Provide CLI flow with Python runtime example.

Quick Start Flow

1. Install Node.js (14+) and npm.
2. Install and validate Serverless Devs.
3. Configure credentials via guided setup.
4. Initialize example project and enter directory.
5. Deploy, invoke, and optionally remove.

Install Serverless Devs (npm)

Global install (requires sudo):

sudo npm install @serverless-devs/s -g
sudo s -v

No-sudo alternative (recommended in restricted environments):

npx -y @serverless-devs/s -v

Configure Credentials (guided)

sudo s config add

Choose Alibaba Cloud (alibaba), provide AccountID, AccessKeyID, AccessKeySecret, and set alias.

Configure Credentials (command)

Use CLI args to configure credential alias in one command (non-interactive):

s config add -a default --AccessKeyID <AK> --AccessKeySecret <SK> -f

If using environment variables, inject them into the command (example):

s config add -a default -kl AccessKeyID,AccessKeySecret -il ${ALIBABA_CLOUD_ACCESS_KEY_ID},${ALIBABA_CLOUD_ACCESS_KEY_SECRET} -f

Or use Serverless Devs convention JSON environment variable (example):

export default_serverless_devs_key='{\"AccountID\":\"<AccountID>\",\"AccessKeyID\":\"<AK>\",\"AccessKeySecret\":\"<SK>\"}'

Reference in s.yaml:

access: default_serverless_devs_key

Initialize Example (Python)

sudo s init start-fc3-python
cd start-fc3-python

Initialization creates s.yaml, code/, and readme.md; edit code/index.py for function logic.

Deploy, Invoke, and Remove

sudo s deploy
sudo s invoke -e "test"
sudo s remove

Custom Domain Binding (Avoid Default Domain Forced Download)

Note: FC default domain adds Content-Disposition: attachment, causing browser downloads. Use a custom domain to avoid this behavior.

Step 1: Configure CNAME for your domain

Configure DNS CNAME to FC public CNAME:

<account_id>.<region_id>.fc.aliyuncs.com

Example (Hangzhou region):

1629965279769872.cn-hangzhou.fc.aliyuncs.com

Note: if using apex domain (e.g. animus.run) and DNS provider does not support CNAME at apex, use ALIAS/ANAME records, or switch to a subdomain such as www.animus.run.

Step 2: Create custom domain in Serverless Devs

Option A: add fc3-domain resource in s.yaml:

resources:
  newsDomain:
    component: fc3-domain
    props:
      region: cn-hangzhou
      domainName: animus.run
      protocol: HTTP
      routeConfig:
        routes:
          - functionName: honnold-taipei101-news
            qualifier: LATEST
            methods:
              - GET
              - HEAD
            path: /*

region is example default; ask user when the best region is unclear.

Then deploy:

printf 'y\n' | npx -y @serverless-devs/s deploy

Option B: use Console (Advanced Features > Custom Domains) to create and route custom domain.

Common Errors

• DomainNameNotResolved: domain not resolved to correct FC CNAME.
• InvalidICPLicense: mainland China regions require ICP filing associated with Alibaba Cloud.

References

• See references/install_serverless_devs_and_docker.md for detailed official steps.

• HTTP trigger limitations and response header behavior (default domain enforces Content-Disposition: attachment)

  • https://www.alibabacloud.com/help/en/functioncompute/fc/user-guide/http-triggers-overview

• Custom domain binding and CNAME guidance

  • https://www.alibabacloud.com/help/en/functioncompute/fc/user-guide/configure-custom-domain-names

• Official source list:references/sources.md

Validation

mkdir -p output/alicloud-compute-fc-serverless-devs
echo "validation_placeholder" > output/alicloud-compute-fc-serverless-devs/validate.txt

Pass criteria: command exits 0 and output/alicloud-compute-fc-serverless-devs/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/alicloud-compute-fc-serverless-devs/.
• Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Prerequisites

• Configure least-privilege Alibaba Cloud credentials before execution.
• Prefer environment variables: ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, optional ALICLOUD_REGION_ID.
• If region is unclear, ask the user before running mutating operations.

Workflow

1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
2. Run one minimal read-only query first to verify connectivity and permissions.
3. Execute the target operation with explicit parameters and bounded scope.
4. Verify results and save output/evidence files.