Alicloud Database Rds Supabase

Manage Alibaba Cloud RDS Supabase (RDS AI Service 2025-05-07) via OpenAPI. Use for creating, starting/stopping/restarting instances, resetting passwords, que...

Security Scan

The skill appears to implement Alibaba Cloud RDS Supabase management, but its runtime instructions require cloud credentials and reference sensitive configuration (including region-resolving/all-region queries and storage credential fields) while the registry metadata declares no required environment variables — this mismatch is concerning and should be clarified before use.

Purpose & Capability

The name/description match the SKILL.md: it manages Alibaba Cloud RDS Supabase via the RDS AI OpenAPI. However the skill's metadata lists no required environment variables or primary credential, while the SKILL.md explicitly instructs the agent to use Alibaba Cloud AccessKey credentials (ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET and optional ALICLOUD_REGION_ID) or the standard credentials file. That omission in metadata is a coherence problem: a cloud-management skill legitimately needs credentials, and they should be declared.

Instruction Scope

SKILL.md gives concrete runtime instructions: read environment variables, check ~/.alibabacloud/credentials, choose regions (and optionally perform all-region queries), call many read/write API operations, and save API responses to output/alicloud-database-rds-supabase/. These instructions are generally within the skill's stated purpose, but they also enable broad enumeration (all-region DescribeAppInstances) and instruct writing outputs that may include secrets (endpoints, auth info, passwords). The document also references storage config fields (e.g., AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) — the skill could request or handle third-party cloud credentials when modifying storage, which is a scope expansion that should be explicit.

Install Mechanism

Instruction-only skill with no install spec and no code files; lowest install risk. Nothing is written to disk by an install step. Runtime behaviour depends entirely on the SKILL.md instructions and the agent environment.

Credentials

The SKILL.md legitimately requires Alibaba Cloud credentials and optionally a region, but the registry metadata lists none. The SKILL.md also references the standard credentials file path (~/.alibabacloud/credentials) and storage configuration parameters that may contain third-party cloud credentials (e.g., AWS_ACCESS_KEY_ID/SECRET, S3 endpoint). Requesting the Alibaba credentials is proportionate to the purpose, but the omission from declared requirements and the possible need for additional storage credentials are inconsistent and potentially confusing for users.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does not claim to modify other skills or global agent settings. Autonomous invocation is allowed by default (normal for skills); combining that with user-provided cloud credentials gives the skill the ability to act on cloud resources — expected for this type of skill but something the user should authorize explicitly.

What to consider before installing

This skill appears to be a legitimate Alibaba Cloud RDS Supabase manager, but the SKILL.md expects you to provide Alibaba access keys (ALICLOUD_ACCESS_KEY_ID and ALICLOUD_ACCESS_KEY_SECRET) or a credentials file even though the registry metadata doesn't declare them. Before installing or running it: (1) only provide a least-privilege RAM user/role (no full-owner keys); (2) confirm the skill author updates metadata to declare required env vars; (3) be cautious about allowing all-region queries — approve those explicitly; (4) beware that output files may contain sensitive data (endpoints, passwords, auth info) and that modifying storage config could require third-party cloud credentials (e.g., S3 keys); and (5) ask the publisher for clarification on what permissions the skill needs and why, or for a minimal permission policy you can apply.

Category: service

Alibaba Cloud RDS Supabase (RDS AI Service 2025-05-07)

Manage RDS Supabase app instances and related configurations via RDS AI Service OpenAPI, including lifecycle, auth, storage, RAG, IP whitelist, and SSL.

Prerequisites

• Use least-privilege RAM user/role AccessKey and prefer environment variables for AK/SK.
• OpenAPI uses RPC signing; prefer official SDKs or OpenAPI Explorer.

Workflow

1. Confirm resource type: instance / auth / storage / RAG / security configuration.
2. Locate operations in references/api_overview.md.
3. Choose invocation method (SDK / OpenAPI Explorer / custom signing).
4. After changes, verify state and configuration with query APIs.

AccessKey Priority (Required)

1. Environment variables (preferred):ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET / ALICLOUD_REGION_ID Region policy: ALICLOUD_REGION_ID is optional default; if unset choose the most reasonable region and ask when unclear.
2. Standard credentials file:~/.alibabacloud/credentials

Default Region Strategy

• If region is not specified, choose the most reasonable region; ask the user when unclear.
• Only run all-region queries when explicitly needed or user-approved (call ListRegions first, then query each region).
• If user provides region, query only that region.

Common Operation Map

• Instance:CreateAppInstance / DeleteAppInstance / StartInstance / StopInstance / RestartInstance
• Connectivity and auth:DescribeInstanceEndpoints / DescribeInstanceAuthInfo / ModifyInstanceAuthConfig
• Storage:DescribeInstanceStorageConfig / ModifyInstanceStorageConfig
• Security:ModifyInstanceIpWhitelist / DescribeInstanceIpWhitelist / ModifyInstanceSSL / DescribeInstanceSSL
• RAG：ModifyInstanceRAGConfig / DescribeInstanceRAGConfig

Clarifying questions (ask when uncertain)

1. What is the target instance ID and region?
2. Is this instance lifecycle management or configuration changes (auth/storage/RAG/IP whitelist/SSL)?
3. Do you need batch operations or an initial state query first?

Output Policy

If you need to save results or responses, write to: output/database-rds-supabase/

Validation

mkdir -p output/alicloud-database-rds-supabase
echo "validation_placeholder" > output/alicloud-database-rds-supabase/validate.txt

Pass criteria: command exits 0 and output/alicloud-database-rds-supabase/validate.txt is generated.

Output And Evidence

• Save artifacts, command outputs, and API response summaries under output/alicloud-database-rds-supabase/.
• Include key parameters (region/resource id/time range) in evidence files for reproducibility.

Prerequisites

• Configure least-privilege Alibaba Cloud credentials before execution.
• Prefer environment variables: ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, optional ALICLOUD_REGION_ID.
• If region is unclear, ask the user before running mutating operations.

Workflow

1. Confirm user intent, region, identifiers, and whether the operation is read-only or mutating.
2. Run one minimal read-only query first to verify connectivity and permissions.
3. Execute the target operation with explicit parameters and bounded scope.
4. Verify results and save output/evidence files.

References

• API overview and operation groups:references/api_overview.md
• Core API parameter quick reference:references/api_reference.md
• All-region query examples:references/query-examples.md
• Official source list:references/sources.md