Alibaba Cloud Security Center (SAS) malicious file detection skill.
Use when the user asks to check whether a file is malicious, scan a file for malware,
detect viruses in files, or scan a directory for malicious files.
Triggers: "malware detection", "malicious file", "file scan", "virus scan",
"is this file safe", "scan for malware", "check file security",
"恶意文件检测", "文件扫描", "病毒扫描", "文件是否恶意".
Scan local files for malware using Alibaba Cloud Security Center's malicious file detection SDK APIs. Supports single file scanning and batch directory scanning.
Architecture: Local Files → MD5 Hash → SAS API (CreateFileDetectUploadUrl) → OSS Upload → SAS API (CreateFileDetect) → SAS API (GetFileDetectResult) → Detection Result
IMPORTANT: Resource Notice — File scanning requires local disk I/O (to compute MD5 hash) and network bandwidth (to upload files to Alibaba Cloud OSS). Large files or directories with many files will consume significant I/O and network resources. Always inform the user before starting a scan.
Installation
Pre-check: Aliyun CLI >= 3.3.3 required
Run aliyun version to verify >= 3.3.3. If not installed or version too low,
run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to install/update,
or see references/cli-installation-guide.md for installation instructions.
Pre-check: Aliyun CLI plugin update required
[MUST] run aliyun configure set --auto-plugin-install true to enable automatic plugin installation.
[MUST] run aliyun plugin update to ensure that any existing plugins are always up-to-date.
System Dependencies:
jq — JSON parsing (brew install jq on macOS, apt install jq on Linux)
curl — OSS file upload
md5sum or md5 — file hash computation (pre-installed on most systems)
Environment Variables
Variable
Required
Description
ALIBABA_CLOUD_ACCESS_KEY_ID
Yes (if no CLI profile)
Alibaba Cloud Access Key ID
ALIBABA_CLOUD_ACCESS_KEY_SECRET
Yes (if no CLI profile)
Alibaba Cloud Access Key Secret
Authentication
Pre-check: Alibaba Cloud Credentials Required
Security Rules:
NEVER read, echo, or print AK/SK values (e.g., echo $ALIBABA_CLOUD_ACCESS_KEY_ID is FORBIDDEN)
NEVER ask the user to input AK/SK directly in the conversation or command line
NEVER use aliyun configure set with literal credential values
ONLY use aliyun configure list to check credential status
bash
aliyun configure list
Check the output for a valid profile (AK, STS, or OAuth identity).
[MUST] Permission Failure Handling: When any command or API call fails due to permission errors at any point during execution, follow this process:
Read references/ram-policies.md to get the full list of permissions required by this SKILL
Use ram-permission-diagnose skill to guide the user through requesting the necessary permissions
Pause and wait until the user confirms that the required permissions have been granted
Parameter Confirmation
IMPORTANT: Parameter Confirmation — Before executing any command or API call,
ALL user-customizable parameters (e.g., file paths, etc.) MUST be confirmed with the
user. Do NOT assume or use default values without explicit user approval.
Parameter
Required
Description
Default
File/Directory Path
Yes
Path to the file or directory to scan
None
RegionId
No
Alibaba Cloud region for API endpoint
See rule below
RegionId default value rule: If the user does not specify RegionId, automatically determine it based on the region in aliyun configure list. Do NOT confirm with the user or display region info; silently use the default value:
Mainland China (region starts with cn-): defaults to cn-shanghai
Non-Mainland China (other regions or not configured): defaults to ap-southeast-1 (Singapore)
Core Workflow
At the start of the Core Workflow (before any CLI invocation):
[MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution.
Run the following commands before any CLI invocation:
[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first.
bash
aliyun configure ai-mode disable
Step 0: Network Connectivity Pre-check
[MUST] Before executing any script, verify network connectivity to the SAS API endpoint:
bash
curl -I --connect-timeout 5 https://tds.aliyuncs.com 2>/dev/null | head -1
If the request succeeds (HTTP 2xx/4xx), proceed to Step 1.
If the request fails (DNS resolution failure, connection timeout, etc.), STOP immediately and inform the user:
Network connectivity check failed — Cannot reach the Alibaba Cloud Security Center API endpoint. Please check:
Whether the network connection is functional
Whether DNS resolution is working
Whether a firewall or proxy is blocking access to tds.aliyuncs.com
Please fix the network issue and retry.
[MUST] If the scanning script execution exceeds 120 seconds without any output, terminate the script and report a timeout error. NEVER silently fall back to local file analysis or skip API calls.
[MUST] Forced circuit-breaker rule: If the script execution exceeds 120 seconds with no output or returns a non-zero exit code, immediately run aliyun configure ai-mode disable and report directly to the user: "Scan script terminated due to timeout; no valid data was obtained." STRICTLY FORBIDDEN to infer, complete, or fabricate any JSON result, MD5 hash value, or cost details based on partial logs from before the timeout. If the script does not exit normally, return failure status directly; do NOT perform any simulated calls or fabricated output.
Step 1: Check Service Availability
[MUST] Before scanning, verify the user has enabled the malicious file detection service:
[MUST] Pre-output authenticity check: Before parsing the result, verify that the JSON returned by the script contains a complete MD5 field matching the 32-character hexadecimal format. If the field is missing, malformed (not 32-char hex), or the script output is empty, immediately terminate the workflow and tell the user "Data validation failed; the scan was not actually executed." STRICTLY FORBIDDEN to display any unverified detection results, fabricated MD5 hash values, or fictional cost details.
Present results to the user in a clear format:
Score Range
Risk Level
Description
0-60
Safe
File is safe
61-70
Risk
File has some risk indicators
71-80
Suspicious
File is suspicious, further analysis recommended
81-100
Malicious
File is highly likely malicious
For directory scans, summarize results:
Total files scanned
Safe files count
Risk/Suspicious/Malicious files count
List any malicious or suspicious files with details (virus type, score)
[MUST] Output validation: Before presenting the final result, extract the full 32-character MD5 hash directly from the JSON output returned by the script. FORBIDDEN to truncate hash fragments from terminal logs. If a hash value in the terminal log differs from the script's JSON output, treat the JSON output as authoritative and reformat the result.
[MUST] Cost validation: Before presenting the final cost report, strictly verify the result of "actual files scanned × unit price" with correct decimal precision (postpaid unit price 0.0015 CNY/scan; e.g., 3 files = 3 × 0.0015 = 0.0045 CNY, 10 files = 10 × 0.0015 = 0.015 CNY). If a numeric discrepancy is found or the Step 2 cost estimation was skipped, immediately correct it and explicitly label the actual cost and billing mode in the output. FORBIDDEN to use approximations or verbal estimates.
[MUST] After presenting detection results, always show the actual cost report:
This scan's cost:
Actual files scanned: {scanned_count}
Scan count consumed: {scanned_count} scans
Cost: {scanned_count * unit_price} CNY ({billing_mode}, unit price {unit_price} CNY/scan)
Prepaid remaining quota: {sdk_capacity} scans (shown only for prepaid users)
[MUST] Disable AI-Mode before delivering the final response:
