Alibabacloud Odps Quota Manage

MaxCompute Quota Management Skill. Use for managing MaxCompute/ODPS quota resources including pay-as-you-go quota creation, query, and listing operations. Tr...

Security Scan

The skill's documentation and runtime instructions are consistent with a MaxCompute/ODPS quota management helper that drives the Aliyun CLI; it asks for no extra credentials and has no install-time code, but it does instruct modifying the global Aliyun CLI configuration (AI-mode and user-agent) and suggests running a remote install script which the user should review before running.

Purpose & Capability

The name/description match the instructions and referenced APIs/CLI commands. All required operations (create/query/list quotas) map to the aliyun maxcompute CLI commands and the listed RAM policies; there are no unrelated credentials, binaries, or policy requests.

Instruction Scope

Runtime instructions are focused on required CLI commands and verification steps. They do instruct the agent/operator to enable/disable the Aliyun CLI AI-mode and to set a custom user-agent (global CLI config changes). They also mandate parameter confirmation and not exfiltrating credentials. Changing global CLI config is within scope for a CLI-based skill but has side effects the user should be aware of.

Install Mechanism

No formal install spec is present (instruction-only), which is low-risk, but SKILL.md suggests installing/updating the Aliyun CLI via a remote setup script (curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash). Executing a remote script is higher-risk even when hosted on an official CDN; prefer verified package managers or manual review of the script before running.

Credentials

The skill does not declare any required environment variables or secrets; it relies on the Aliyun CLI's normal credential chain (~/.aliyun/config.json, env vars, or ECS RAM role), which is proportionate for interacting with Aliyun APIs. The included docs show how to set credentials but do not require the skill to directly handle secret values.

Persistence & Privilege

The skill does not request persistent platform privileges (always:false) nor modify other skills. However, it instructs enabling AI-mode and setting a user-agent in the global Aliyun CLI config; although the SKILL.md instructs disabling AI-mode at every exit, that relies on correct cleanup. Users should be aware these commands change user config and may persist if the workflow is interrupted.

Scan Findings in Context

[no-findings] expected: The package is instruction-only with no code files, so the regex scanner had nothing to analyze; this is expected. The primary surface is the SKILL.md instructions.

Assessment

This skill appears to do what it says: it uses the Aliyun CLI to list, query, and create MaxCompute quotas and documents required RAM policies. Before installing or running it, consider: 1) The SKILL.md asks you to enable 'AI-mode' and set a user-agent in your global Aliyun CLI config—these are persistent changes; ensure you (or your CI/user) are comfortable with the CLI being modified and that AI-mode is disabled after use. 2) The README suggests installing the CLI by piping a remote script (curl | bash). Even if the URL is an official CDN, review the script or use a package manager/binary installation method you trust. 3) Use least-privilege RAM credentials: create a RAM user or scoped policy with only odps:CreateQuota/QueryQuota/ListQuotas if you only need quota operations. 4) The skill relies on local Aliyun CLI credentials/config—do not paste secret keys into third-party environments; run the skill in a controlled environment (local machine, ephemeral container, or CI with scoped credentials). If you want higher assurance, request an explicit install spec that uses vetted package managers or ask the publisher for a signed release or additional provenance information.

MaxCompute Quota Management

Manage MaxCompute (ODPS) Quota resources using Alibaba Cloud CLI and SDK. This skill covers pay-as-you-go quota creation, quota query, and quota listing operations.

Limitations and Notes

Feature	CLI Support	SDK Support	Notes
Create Pay-as-you-go Quota	✅ Yes	✅ Yes	Fully supported
Create Subscription Quota	❌ Not Supported	❌ Not Supported	Temporarily unavailable
Query Quota (get-quota)	✅ Yes	✅ Yes	⚠️ Deprecated - Use query-quota instead
Query Quota (query-quota)	✅ Yes	✅ Yes	Recommended replacement for get-quota
List Quotas	✅ Yes	✅ Yes	Fully supported (both payasyougo and subscription)
Delete Quota	❌ No API	❌ No API	Not available via API - Must use Console
Modify Quota	❌ Not in scope	❌ Not in scope	Not covered in this solution

Important:

• Create Subscription Quota is temporarily NOT supported in this skill. For subscription quota creation, please use the Alibaba Cloud Console.
• Delete Quota operation is NOT available through CLI or SDK. You must use the Alibaba Cloud Console to delete quotas.
• query-quota is preferred - get-quota is deprecated but acceptable if it returns success
• ⚠️ CRITICAL: When checking if quota exists, ALWAYS use list-quotas, NEVER use get-quota
• 🚨 MANDATORY: Before create-quota, MUST call list-quotas first - NEVER skip this step

Architecture

Alibaba Cloud Account → MaxCompute Service → Quota Resources (CU)
                                           ├── Pay-as-you-go Quota (后付费) ← **Creation Supported**
                                           └── Subscription Quota (预付费) ← Query/List only

Installation

Pre-check: Aliyun CLI >= 3.3.3 required Run aliyun version to verify >= 3.3.3. If not installed or version too low, run curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash to update, or see references/cli-installation-guide.md for installation instructions.

Pre-check: Aliyun CLI plugin setup required [MUST] Install the maxcompute plugin manually: aliyun plugin install maxcompute [MUST] Update the plugin to latest version: aliyun plugin update maxcompute

# Verify CLI version
aliyun version

# Install maxcompute plugin (confirm when prompted)
aliyun plugin install maxcompute

# Update maxcompute plugin to latest version
aliyun plugin update maxcompute

[MUST] CLI User-Agent — Every aliyun CLI command invocation must include: --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

At the start of the Core Workflow (before any CLI invocation): [MUST] Enable AI-Mode — AI-mode is required for Agent Skill execution. Run the following commands before any CLI invocation:

aliyun configure ai-mode enable
aliyun configure ai-mode set-user-agent --user-agent "AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage"

[MUST] Disable AI-Mode at EVERY exit point — Before delivering the final response for ANY reason, always disable AI-mode first. This applies to ALL exit paths: workflow success, workflow failure, error/exception, user cancellation, session end, or any other scenario where no further CLI commands will be executed. AI-mode is only used for Agent Skill invocation scenarios and MUST NOT remain enabled after the skill stops running.

aliyun configure ai-mode disable

Environment Variables

This skill relies on the aliyun CLI default credential chain. No explicit credential configuration is needed.

• Run aliyun configure to set up credentials before first use
• Do NOT explicitly handle or pass credential values in commands

Timeout Configuration:

• ALIBABA_CLOUD_CONNECT_TIMEOUT: Connection timeout (default: 10s)
• ALIBABA_CLOUD_READ_TIMEOUT: Read timeout (default: 10s)
• These defaults are sufficient for quota operations; no explicit configuration required

Parameter Confirmation

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters (e.g., RegionId, quota nicknames, billing types, etc.) MUST be confirmed with the user. Do NOT assume or use default values without explicit user approval.

Input Validation

Parameter	Validation Rules
RegionId	Must be valid Alibaba Cloud region ID (e.g., cn-hangzhou, cn-shanghai)
nickname	Max 64 characters; alphanumeric, hyphens (-), underscores (_); URL-encode if contains Chinese characters
chargeType	Must be payasyougo (subscription not supported)
commodityCode	Must be odps, odpsplus, odps_intl, or odpsplus_intl
billingType	Must be payasyougo, subscription, or ALL

Security Note: All user inputs are passed to aliyun CLI which handles parameter sanitization. Do NOT construct commands using string concatenation with raw user input.

Parameter Name	Required/Optional	Description	Default Value
RegionId	Required	Alibaba Cloud region (e.g., cn-hangzhou, cn-shanghai)	-
chargeType	Required	Billing type: payasyougo only (subscription not supported)	-
commodityCode	Required	Product code (see table below)	-
billingType	Optional	Filter for listing: subscription or payasyougo or ALL	ALL
maxItem	Optional	Max items per page for listing	100

Commodity Codes (for Pay-as-you-go)

Site	Commodity Code
China (国内站)	odps
International (国际站)	odps_intl

Authentication

Security: Never expose credentials

• Don't print AK/SK values
• Don't ask user to type AK/SK in chat
• Don't use aliyun configure set with hardcoded values

Check credentials:

aliyun configure list

If no credentials, ask user to run aliyun configure first, then continue.

Core Workflow

🚨 STEP 0 - CONFIRM PARAMETERS WITH USER BEFORE ANY EXECUTION:

Before running any CLI command, you MUST confirm all required parameters with the user:

• For LIST: Confirm region and billing-type (payasyougo / subscription / ALL)
• For QUERY: Confirm region and nickname
• For CREATE: Confirm region, charge-type, and commodity-code

Do NOT assume or use default values. Ask the user explicitly and wait for confirmation before proceeding.

🚨 CRITICAL RULE FOR ALL OPERATIONS:

Operation	First Command	Then
CREATE quota	list-quotas	If empty → Create; If exists → Stop
QUERY quota	query-quota	Show results
LIST quotas	list-quotas	Show list

⚠️ CREATE without list-quotas first = ERROR

---

FORBIDDEN COMMANDS - NEVER USE:

• ❌ aliyun quotas commands - WRONG SERVICE (Quota Center), use MaxCompute instead
• ❌ Any BssOpenApi commands for quota operations - use MaxCompute instead
• ❌ get-quota - DEPRECATED, use query-quota instead

MUST USE (plugin mode, kebab-case):

• ✅ aliyun maxcompute list-quotas - For listing/checking quotas
• ✅ aliyun maxcompute query-quota - For querying quota details
• ✅ aliyun maxcompute create-quota - For creating quota

⚠️ IMPORTANT: Use aliyun maxcompute commands (MaxCompute service), NOT aliyun quotas commands (Quota Center service).

Command Rules:

• ALL CLI commands use plugin mode (kebab-case): create-quota, list-quotas, query-quota
• Parameters also use kebab-case: --charge-type, --commodity-code, --billing-type

---

CREATE Quota (CHECK FIRST - THEN CREATE):

🚨 PREPAID/SUBSCRIPTION QUOTAS ARE FORBIDDEN: This skill ONLY supports pay-as-you-go quota creation.

• If user wants prepaid/subscription quota → Tell them to use Alibaba Cloud Console
• Do NOT attempt to create prepaid quotas

🚨 FOR CREATE: FIRST RUN LISTQUOTAS - NEVER SKIP THIS:

STEP 1 - MANDATORY: Call list-quotas FIRST

aliyun maxcompute list-quotas --billing-type payasyougo --region <R>

DO NOT proceed to Step 2 until you get list-quotas result

Use MaxCompute service (aliyun maxcompute), NOT Quota Center (aliyun quotas).

AFTER list-quotas result (STEP 2):

Result	Action
List shows quota	DO NOT CREATE - Inform user "Quota already exists" → Done
List is empty	Go to Step 3 (Create)

STEP 3 - ONLY IF LIST WAS EMPTY:

PRE-CREATE CHECKLIST - ALL MUST BE TRUE:

• User wants pay-as-you-go (NOT prepaid/subscription)
• list-quotas was called and returned empty list
• No existing pay-as-you-go quota in the region
• User confirmed they want to create

aliyun maxcompute create-quota --charge-type payasyougo --commodity-code odps --region <R> --client-token <UNIQUE_TOKEN>

For International Site:

aliyun maxcompute create-quota --charge-type payasyougo --commodity-code odps_intl --region <R> --client-token <UNIQUE_TOKEN>

CRITICAL:

• Use plugin mode (kebab-case): create-quota
• Use MaxCompute service, NOT BssOpenApi
• client-token: Generate a unique token (e.g., UUID) for idempotency on retries
• commodityCode values:
  • China site: odps or odpsplus
  • International site: odps_intl or odpsplus_intl
  • NEVER use maxcompute as commodityCode
  • Note: When chargeType=payasyougo is set, commodityCode validation is not strict

⚠️ OUTPUT HANDLING:

• Do NOT pipe command output to files (e.g., | tee ... or > file.json) — if the target directory does not exist, the command will return a non-zero exit code even when the API call succeeds.
• Let the CLI print output directly to stdout, then parse the result inline.
• When saving output files (e.g., existing_quotas.json, actions_log.txt), ALWAYS mkdir -p <directory> first before writing any file to ensure the target directory exists.

FINALLY:

• Parse result
• Show user
• Done

⚠️ NEVER call create-quota before list-quotas. This causes errors.

Note: If quota already exists, DO NOT create. Only create when list-quotas returns empty list.

QUERY Quota (when user provides nickname):

PRIORITY: Use query-quota as the primary API for querying specific quota details by nickname.

CHECKLIST:

• User provided quota nickname
• Use query-quota (NOT get-quota)

USE THIS COMMAND:

aliyun maxcompute query-quota --nickname <N> --region <R>

IMPORTANT: If nickname contains Chinese characters, URL-encode it first before passing to the command.

FORBIDDEN: get-quota is deprecated - use query-quota instead.

• Parse JSON
• Extract: nickName, name, id, status
• Show all fields → Done

LIST Quotas:

⚠️ FOR LISTING QUOTAS: ONLY use MaxCompute list-quotas, NOT BssOpenApi

When checking for existing pay-as-you-go quotas (before creation):

aliyun maxcompute list-quotas --billing-type payasyougo --region <R>

MUST include --billing-type payasyougo to filter at API level.

When listing all quotas (user request):

aliyun maxcompute list-quotas --billing-type ALL --region <R>

billingType parameter:

• Valid values: payasyougo, subscription, ALL

• If not set, defaults to ALL

• Use payasyougo when checking for existing pay-as-you-go quotas

• Parse JSON

• Extract quotaInfoList array

• Show list → Done

Response field odpsSpecCode enum values:

odpsSpecCode	Description
OdpsStandard	ODPS Pay-as-you-go Resource
OdpsSpot	ODPS Spot/Off-peak Resource (Pay-as-you-go)
OdpsDev	Developer Resource Type
OdpsPlusStandard	Subscription Resource
OdpsPlusHa	High Availability Resource
OdpsPlusElasticCU	ODPS Non-reserved Elastic CU Subscription Resource

---

Quick Reference

See references/related-apis.md for complete CLI command reference and response format details.

Key Points:

• Use list-quotas --billing-type payasyougo before creating
• Use query-quota (not get-quota) for querying
• Use create-quota (kebab-case plugin mode) for creating
• Always include --user-agent AlibabaCloud-Agent-Skills/alibabacloud-odps-quota-manage

---

Task Completion

Output Files — MUST create before finishing:

1. mkdir -p outputs ran_scripts — ensure directories exist first
2. Save quota query/list results to outputs/existing_quotas.json
3. Save a log of all actions performed to ran_scripts/actions_log.txt

IMPORTANT: Always run mkdir -p for any target directory BEFORE writing files. Never assume directories already exist.

Finish with:

• Summary of what was done
• Key results (nickname, region, status)
• Confirm output files were written (outputs/existing_quotas.json, ran_scripts/actions_log.txt)
• "✅ Complete"

---

Error Handling

Error Code	What to Do
QuotaAlreadyExists	Quota exists → Query it and show details → Task complete
QuotaNotFound	Quota doesn't exist → Inform user
InvalidParameter	Wrong parameter format → Check with user
Forbidden	No permission → Direct to Console
INTERNAL_ERROR	Retry once or contact support

---

Cleanup

No Delete API - Must use Console to delete quotas

API Reference

See references/related-apis.md for complete API reference, CLI commands, and response formats.

Best Practices

1. Always confirm region with user before any operation
2. For creation: First list to check if quota exists (one per region limit)
3. If quota exists: Query it for user instead of trying to create
4. Use query-quota (NOT get-quota) for quota details
5. For subscription quotas: Direct user to Alibaba Cloud Console

Reference Links

Reference	Description
references/related-apis.md	Complete CLI commands and API reference
references/ram-policies.md	Required RAM permissions
references/verification-method.md	Success verification steps
references/acceptance-criteria.md	Testing acceptance criteria
references/cli-installation-guide.md	CLI installation guide

Related Documentation

• MaxCompute Product
• create-quota API
• get-quota API
• list-quotas API
• Java SDK Documentation
• Credential Management